Full Report
Two vulnerabilities have been identified in the SIMATIC S7-1200/S7-1500 CPU families and related products. One vulnerability (CVE-2019-10943) could allow an attacker with network access to affected devices to modify the user program stored on these devices such that the source code differs from the actual running code. The other vulnerability (CVE-2019-10929) could allow an attacker in a Man-in-the-Middle position to modify network traffic exchanged on port 102/tcp. Siemens has released updates for several affected products to fix CVE-2019-10929 and recommends to update to the latest versions. Regarding CVE-2019-10943, Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Siemens SIMATIC S7-1200/S7-1500 Program Modification and Traffic Manipulation
## CVE Details
- **CVE ID:** CVE-2019-10943
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-654 (Reliance on Portability of Software to a Target System)
- **CVE ID:** CVE-2019-10929
- **CVSS Score:** 6.8 (Medium)
- **CWE:** CWE-319 (Cleartext Transmission of Sensitive Information)
## Affected Systems
- **Products:**
- SIMATIC S7-1200 CPU family
- SIMATIC S7-1500 CPU family
- SIMATIC S7-1500 Software Controller
- SIMATIC Drive Controller
- ET 200SP Open Controller
- **Versions:** Multiple versions prior to the 2019 security updates (specific versions vary by product line; generally pre-v4.x for S7-1200 and pre-v2.x for S7-1500).
- **Configurations:** Devices with network access enabled via Port 102/tcp (ISO-on-TCP).
## Vulnerability Description
- **CVE-2019-10943:** This flaw allows an attacker to manipulate the user program such that the source code viewed by an engineer in the TIA Portal differs from the actual compiled code running on the PLC. This creates a "phantom" logic scenario where the PLC performs actions not visible during a standard code review or "upload" from the device.
- **CVE-2019-10929:** This vulnerability stems from a lack of robust cryptographic protection on Port 102/tcp. An attacker positioned between the engineering workstation and the PLC (Man-in-the-Middle) can intercept and modify the communication traffic.
## Exploitation
- **Status:** Not reported as exploited in the wild at the time of advisory; PoC concepts exist for S7 protocol manipulation.
- **Complexity:**
- CVE-2019-10943: Medium
- CVE-2019-10929: High (Requires MitM positioning)
- **Attack Vector:** Network
## Impact
- **Confidentiality:** None to Low
- **Integrity:** High (Ability to alter PLC logic and operational behavior)
- **Availability:** Medium (Logic changes could lead to process shutdowns)
## Remediation
### Patches
Siemens released firmware updates to address CVE-2019-10929. Users are urged to upgrade to:
- **S7-1200:** v4.4 or later
- **S7-1500:** v2.8 or later
- **S7-1500 Software Controller:** v2.8 or later
### Workarounds
For products where patches for CVE-2019-10943 are unavailable:
- **Enable Protection Levels:** Configure "Read/Write" protection with a strong password on the CPU.
- **Use Secure Communication:** Utilize the "Protected PLC communication" (TLS-based) feature available in newer TIA Portal/Firmware versions.
- **Network Isolation:** Ensure industrial networks are isolated from corporate networks and the internet.
## Detection
- **Indicators of Compromise:** Discrepancies between expected process behavior and the logic displayed in the engineering station. Unexpected checksum (hash) changes in the PLC project.
- **Detection methods and tools:**
- Compare offline project backups with the online CPU state.
- Use Industrial Intrusion Detection Systems (IDS) to monitor for unauthorized S7 protocol "Write" commands or MitM signatures on Port 102/tcp.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-232418[.]pdf
- **Siemens Security Advisory:** hxxps[://]www[.]siemens[.]com/cert/advisories