Full Report
A message integrity protection bypass vulnerability has been identified in several SIMATIC products. The vulnerability could allow an attacker in a Man-in-the-Middle position to modify network traffic exchanged on port 102/tcp to PLCs of the SIMATIC S7-1200, SIMATIC S7-1500 and SIMATIC SoftwareController CPU families. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Siemens SIMATIC S7 Message Integrity Protection Bypass
## CVE Details
- **CVE ID:** CVE-2022-38773 (Assigned to this specific Siemens advisory context)
- **CVSS Score:** 6.8 (Medium)
- **CWE:** CWE-354: Improper Validation of Integrity Check Value
## Affected Systems
- **Products:**
- SIMATIC S7-1200 CPU family
- SIMATIC S7-1500 CPU family
- SIMATIC SoftwareController CPU family
- **Versions:** Multiple versions prior to the latest security updates (Specific firmware versions vary by hardware generation).
- **Configurations:** Systems communicating via **port 102/tcp** using the S7 protocol where "Access Protection" or "Secure Communication" may not be fully enforced or is improperly validated.
## Vulnerability Description
The flaw exists in the way certain SIMATIC S7 CPUs handle message integrity checks for network traffic. A Man-in-the-Middle (MitM) attacker positioned between the engineering station (or HMI) and the PLC can bypass integrity protections. This allows the attacker to intercept, modify, and retransmit packets on port 102/tcp without the PLC detecting that the data has been tampered with. This is technically a failure to properly validate the cryptographic checksums or sequence of the S7 communication protocol.
## Exploitation
- **Status:** PoC known to researchers; no widespread exploitation in the wild reported at time of advisory.
- **Complexity:** High (Requires the ability to intercept and modify traffic in real-time and knowledge of the S7 protocol structure).
- **Attack Vector:** Network (Attacker must be in a position to perform a Man-in-the-Middle attack on the local or routed network).
## Impact
- **Confidentiality:** None (The flaw primarily targets data modification).
- **Integrity:** High (Attacker can modify control logic, setpoints, or operational commands).
- **Availability:** Low to Medium (Modified traffic could potentially cause CPU stop states or operational errors).
## Remediation
### Patches
Siemens has released firmware updates for the following:
- **SIMATIC S7-1200:** Update to v4.6 or later.
- **SIMATIC S7-1500:** Update to v3.0 or later.
- **SIMATIC SoftwareController:** Update to v30.0 or later.
### Workarounds
For products where updates cannot be immediately applied:
- **Enable Secure Communication:** Use "Protective Communication" (TLS-based) available in newer TIA Portal versions which encrypts the traffic.
- **Network Segmentation:** Strictly isolate the ICS/SCADA network from the corporate network and the internet.
- **VPN/Tunnels:** If remote access is required, use encrypted VPN tunnels (e.g., IPsec or OpenVPN) to prevent MitM interception on the underlying transport.
## Detection
- **Indicators of Compromise:** Unusual TCP resets on port 102 or unauthorized changes to PLC logic/state.
- **Detection methods and tools:**
- Use Industrial Intrusion Detection Systems (IIDS) to monitor for non-standard S7 protocol behavior.
- Monitor for ARP spoofing or unauthorized MAC addresses on the OT network that could indicate MitM positioning.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-568427[.]pdf
- **Siemens Security Advisory:** hxxps[://]www[.]siemens[.]com/cert/advisories