ICS Advisory

Siemens SINEMA Remote Connect Server

Last Revised
Alert Code
ICSA-22-167-17

1. EXECUTIVE SUMMARY

  • CVSS v3 9.8
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Siemens
  • Equipment: SINEMA Remote Connect Server
  • Vulnerabilities: Multiple

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, disclose information, or allow code execution.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Siemens products are affected:

  • Siemens SINEMA Remote Connect Server: All versions prior to v3.1

3.2 VULNERABILITY OVERVIEW

3.2.1    USE OF INCORRECTLY-RESOLVED NAME OR REFERENCE CWE-706

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse. Errors in the logic could lead to libcurl reusing wrong connections.

CVE-2021-22924 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

 

3.2.2    USE OF UNINITIALIZED RESOURCE CWE-908

curl supports the -t command line option, known as CURLOPT_TELNETOPTIONS in libcurl. Due to a flaw in the option parser, libcurl could pass on uninitialized data from a stack-based buffer to the server, revealing sensitive internal information to the server.

CVE-2021-22925 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

3.2.3    UNCONTROLLED RESOURCE CONSUMPTION CWE-400

In Expat, also called libexpat, versions prior to 2.4.3 a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior.

CVE-2021-45960 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

3.2.4    INTEGER OVERFLOW OR WRAPAROUND CWE-190

In doProlog in xmlparse.c in Expat, also called libexpat, versions prior to 2.4.3, an integer overflow exists for m_groupSize.

CVE-2021-46143 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.5    INTEGER OVERFLOW OR WRAPAROUND CWE-190

addBinding in xmlparse.c in Expat, also called libexpat, has an integer overflow in versions prior to 2.4.3.

CVE-2022-22822 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.6    INTEGER OVERFLOW OR WRAPAROUND CWE-190

build_model in xmlparse.c in Expat, also called libexpat, has an integer overflow in versions prior to 2.4.3.

CVE-2022-22823 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.7    INTEGER OVERFLOW OR WRAPAROUND CWE-190

defineAttribute in xmlparse.c in Expat, also called libexpat, has an integer overflow in versions prior to 2.4.3.

CVE-2022-22824 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.8    INTEGER OVERFLOW OR WRAPAROUND CWE-190

lookup in xmlparse.c in Expat, also called libexpat, has an integer overflow in versions prior to 2.4.3.

CVE-2022-22825 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.9    INTEGER OVERFLOW OR WRAPAROUND CWE-190

nextScaffoldPart in xmlparse.c in Expat, also called libexpat, has an integer overflow in versions prior to 2.4.3.

CVE-2022-22826 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.10    INTEGER OVERFLOW OR WRAPAROUND CWE-190

storeAtts in xmlparse.c in Expat, also called libexpat, has an integer overflow in versions prior to 2.4.3.

CVE-2022-22827 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.11    INTEGER OVERFLOW OR WRAPAROUND CWE-190

Expat, also called libexpat, versions prior to 2.4.4 have a signed integer overflow in XML_GetBuffer for configurations with a nonzero XML_CONTEXT_BYTES.

CVE-2022-23852 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.12    INTEGER OVERFLOW OR WRAPAROUND CWE-190

Expat, also called libexpat, versions prior to 2.4.4 have an integer overflow in the doProlog function.

CVE-2022-23990 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.13    IMPROPER ENCODING OR ESCAPING OF OUTPUT CWE-116

xmltok_impl.c in Expat, also called libexpat, versions prior to 2.4.5 lack a certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

CVE-2022-25235 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.14    EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668

xmlparse.c in Expat, also called libexpat, versions prior to 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

CVE-2022-25236 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.15    UNCONTROLLED RESOURCE CONSUMPTION CWE-400

In Expat, also called libexpat, versions prior to 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

CVE-2022-25313 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

3.2.16    INTEGER OVERFLOW OR WRAPAROUND CWE-190

In Expat, also called libexpat versions prior to 2.4.5, there is an integer overflow in copyString.

CVE-2022-25314 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.17    INTEGER OVERFLOW OR WRAPAROUND CWE-190

In Expat, also called libexpat, versions prior to 2.4.5, there is an integer overflow in storeRawNames.

CVE-2022-25315 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.18    CRYPTOGRAPHIC ISSUES CWE-310

An attacker employing a machine-in-the-middle attack could obtain plaintext secret values by observing length differences during a series of guesses, in which a string in an HTTP request URL matches an unknown string in an HTTP response body (i.e., BREACH attack).

CVE-2022-27221 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.2.19    IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79

An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code, allowing reflected cross-site scripting attacks.

CVE-2022-29034 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

3.2.20    MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306

There is a missing authentication verification for a resource used to change the roles and permissions of a user. This could allow an attacker to change the permissions of any user and gain privileges of an administrative user.

CVE-2022-32251 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

3.2.21    INSUFFICIENT VERIFICATION OF DATA AUTHENTICITY CWE-345

The application does not perform the integrity check of the update packages. Without validation, an admin user could be tricked to install a malicious package, granting root privileges to an attacker.

CVE-2022-32252 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

3.2.22    IMPROPER INPUT VALIDATION CWE-20

Due to improper input validation, the OpenSSL certificate’s password could be printed to a file reachable by an attacker.

CVE-2022-32253 has been assigned to this vulnerability. A CVSS v3 base score of 4.9 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).

3.2.23    INSERTION OF SENSITIVE INFORMATION INTO LOG FILE CWE-532

A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information.

CVE-2022-32254 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

3.2.24    IMPROPER ACCESS CONTROL CWE-284

The affected application’s web service lacks proper access control for some endpoints. This vulnerability could lead to unauthorized access to information.

CVE-2022-32255 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

3.2.25    IMPROPER ACCESS CONTROL CWE-284

The affected application’s web service lacks proper access control for some endpoints. This could lead to low privileged users’ access to privileged information.

CVE-2022-32256 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

3.2.26    OBSOLETE FEATURE IN UI CWE-448

The affected application allows the import of device configurations via a specific endpoint, which could allow information disclosure.

CVE-2022-32258 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

3.2.27    IMPROPER ACCESS TO SENSITIVE INFORMATION USING DEBUG AND TEST INTERFACES CWE-1244

The system images for installation or update of the affected application contain unit test scripts with sensitive information. An attacker could gain information about testing architecture and tamper with test configuration.

CVE-2022-32259 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

3.2.28    INCORRECT USER MANAGEMENT CWE-286

The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authentication bypass.

CVE-2022-32260 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).

3.2.29    IMPROPER HANDLING OF PARAMETERS CWE-223

The affected application contains a misconfiguration in the APT update. This vulnerability could allow an attacker to add insecure packages to the application.

CVE-2022-32261 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

3.2.30    IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND INJECTION') CWE-77

The affected application contains a file upload server vulnerable to command injection. An attacker could exploit this vulnerability to achieve arbitrary code execution.

CVE-2022-32262 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Multiple Sectors
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens notified CISA of these vulnerabilities.

4. MITIGATIONS

Siemens recommends updating the products to the latest version of their software:

The update of SINEMA Remote Connect Server to v3.1 also contains additional fixes for vulnerabilities documented in the following Siemens Security Advisories:

For further inquiries on security vulnerabilities in Siemens products and solutions, contact Siemens.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see Siemens Security Advisory SSA-484086

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

  • Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolate them from the business network.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.



CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov/ics in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.



Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities.

This product is provided subject to this Notification and this Privacy & Use policy.

Vendor

  • Siemens

Please share your thoughts

We recently updated our anonymous product survey; we’d welcome your feedback.