Full Report
IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC products are affected by a security vulnerability which could allow an attacker to either exfiltrate limited data from the system or to execute code with operating system user permissions. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and recommends specific countermeasures until patches are available.
Analysis Summary
# Vulnerability: Multiple Siemens Industrial Products Incorrect Input Validation
## CVE Details
- **CVE ID:** CVE-2022-43514
- **CVSS Score:** 7.8 (High)
- **CWE:** CWE-20 (Improper Input Validation) / CWE-611 (Improper Restriction of XML External Entity Reference)
## Affected Systems
- **Products:**
- IEC 61850 System Configurator
- DIGSI 5
- DIGSI 4
- SICAM PAS/PQS
- SICAM PQ Analyzer
- SICAM SCC
- **Versions:**
- IEC 61850 System Configurator: All versions < V9.30
- DIGSI 5: All versions < V9.30
- SICAM PAS/PQS: All versions < V8.21
- SICAM PQ Analyzer: All versions < V3.21
- SICAM SCC: All versions < V9.10
- DIGSI 4: All versions
- **Configurations:** Systems utilizing affected software for power automation, grid configuration, and substation management.
## Vulnerability Description
The vulnerability stems from improper validation of input data within the affected software components. Specifically, the flaw resides in how the application processes certain XML-based files or configuration data. An attacker can exploit this by providing specially crafted input (such as an XML External Entity - XXE) that the system fails to sanitize. This failure allows the attacker to either read local files (data exfiltration) or, in certain conditions, achieve remote code execution (RCE) within the context of the operating system user running the application.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC may exist in private research circles.
- **Complexity:** Medium
- **Attack Vector:** Network (Typically requires the attacker to entice a user to open a malicious file or have network access to an interface processing these files).
## Impact
- **Confidentiality:** High (Data exfiltration of sensitive configuration or system files).
- **Integrity:** High (Potential for unauthorized code execution and system modification).
- **Availability:** Medium (Potential for service disruption via code execution).
## Remediation
### Patches
Siemens has released the following updates to address the flaw:
- **IEC 61850 System Configurator:** Update to V9.30 or later.
- **DIGSI 5:** Update to V9.30 or later.
- **SICAM PAS/PQS:** Update to V8.21 or later.
- **SICAM PQ Analyzer:** Update to V3.21 or later.
- **SICAM SCC:** Update to V9.10 or later.
### Workarounds
For products where updates are not yet applied or for **DIGSI 4** (which may require specific lifecycle management):
- **Restrict File Access:** Ensure only trusted personnel can import or open configuration files.
- **Principle of Least Privilege:** Run the affected software with the minimum necessary OS user permissions to limit the scope of potential code execution.
- **Network Segmentation:** Isolate engineering workstations from the corporate network and the internet.
## Detection
- **Indicators of Compromise:** Unusual outbound network traffic from engineering workstations; unauthorized access to sensitive local files (e.g., `/etc/passwd` or Windows configuration files) initiated by the affected application processes.
- **Detection methods:** Monitor for XML-based attacks using Intrusion Detection Systems (IDS) with signatures focused on XXE patterns. Log and audit all file import actions within the Siemens software suite.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-844950[.]pdf
- **Siemens ProductCERT:** hxxps[://]www[.]siemens[.]com/cert
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2022-43514