Full Report
Vulnerable products include ROX II operating system, SIMATIC S7-1200 CPU family, SCALANCE W1750D access point and some SIMATIC PLCs
Analysis Summary
The following summary is based on the Siemens security updates released in October 2018 regarding the ROX II operating system, SIMATIC S7-1200, and SCALANCE W1750D.
# Vulnerability: Multi-Product Siemens Industrial Security Updates (October 2018)
## CVE Details
*Note: This update addressed multiple vulnerabilities across different product lines.*
- **CVE ID:** CVE-2018-13808, CVE-2018-13809 (ROX II); CVE-2018-13811, CVE-2018-13812, CVE-2018-13813 (S7-1200); CVE-2018-5390, CVE-2018-5391 (SCALANCE W1750D)
- **CVSS Score:** 7.5 to 9.8 (High to Critical)
- **CWE:** CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-119 (Memory Corruption)
## Affected Systems
- **Products:**
- RUGGEDCOM ROX II
- SIMATIC S7-1200 CPU Family
- SIMATIC S7-1500, S7-1500 Software Controller, ET 200SP, ET 200pro
- SCALANCE W1750D Access Points
- **Versions:**
- RUGGEDCOM ROX II: All versions prior to v2.12.1
- SIMATIC S7-1200: All versions prior to v4.2.3
- SCALANCE W1750D: All versions prior to v8.3.0.1
- **Configurations:** Systems with web management interfaces enabled or those processing specific TCP/IP traffic segments.
## Vulnerability Description
The updates addressed several distinct technical flaws:
1. **ROX II:** Improper validation of input in the web interface could allow an authenticated remote attacker to perform command injection or privilege escalation.
2. **S7-1200/S7-1500:** Vulnerabilities in the integrated web server where specially crafted HTTP packets could cause a Denial of Service (DoS) condition, requiring a manual restart.
3. **SCALANCE W1750D (SegmentSmack/FragmentSmack):** Vulnerabilities in the Linux Kernel TCP stack (CVE-2018-5390 and CVE-2018-5391) where specially crafted TCP/IP sequences cause excessive CPU consumption, leading to a system hang or DoS.
## Exploitation
- **Status:** PoC available for SegmentSmack/FragmentSmack; no known active exploitation in the wild at the time of release for Siemens-specific flaws.
- **Complexity:** Low to Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Low to High (depending on the specific component)
- **Integrity:** High
- **Availability:** Critical (Total loss of control/visibility via DoS)
## Remediation
### Patches
- **RUGGEDCOM ROX II:** Update to v2.12.1 or later.
- **SIMATIC S7-1200:** Update to v4.2.3 or later.
- **SIMATIC S7-1500:** Update to v2.5 or later.
- **SCALANCE W1750D:** Update to v8.3.0.1 or later.
### Workarounds
- **Disable Web Services:** If the web server/management interface is not required, disable it to reduce the attack surface.
- **Network Segmentation:** Ensure industrial controllers (PLCs) are not exposed to the internet and are isolated from the corporate network.
- **Firewall Rules:** Filter incoming traffic to ports 80/443 only to authorized management workstations.
## Detection
- **Indicators of Compromise:** Unexpected CPU spikes to 100%, unresponsive web interfaces, or repeated device reboots.
- **Detection Methods:** Use IDS/IPS signatures specifically tuned for SegmentSmack (CVE-2018-5390) and monitor for malformed HTTP requests targeting Siemens TIA portal ports.
## References
- Siemens ProductCERT: hxxps[://]cert-portal[.]siemens[.]com/
- Kaspersky ICS-CERT: hxxps[://]ics-cert[.]kaspersky[.]com/publications/blog/2018/10/12/siemens-fixes-new-vulnerabilities-in-its-products/
- NIST NVD: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2018-5390