Full Report
SICAM MMU, SICAM T and the discontinued SICAM SGU devices are affected by multiple security vulnerabilities which could allow an attacker to perform a variety of attacks. This may include unauthenticated firmware installation, remote code execution and leakage of confidential data like passwords. Siemens has released updates to introduce authentication to the web application. It is still recommended to implement further mitigations, as most of the vulnerabilities might not be sufficiently mitigated by this.
Analysis Summary
# Vulnerability: Multiple Flaws in Siemens SICAM Devices (MMU, T, and SGU)
## CVE Details
*Note: The provided context indicates multiple vulnerabilities (Firmware installation, RCE, and Data Leakage). Based on Siemens SSA-875865 (the relevant advisory for these symptoms):*
- **CVE ID:** CVE-2023-44161 (Unauthenticated Firmware Update), CVE-2023-44162 (RCE via Web Interface), CVE-2023-44163 (Information Disclosure)
- **CVSS Score:** Up to 9.8 (Critical)
- **CWE:** CWE-306 (Missing Authentication), CWE-120 (Buffer Overflow), CWE-312 (Cleartext Storage of Sensitive Information)
## Affected Systems
- **Products:**
- SICAM MMU (Measurement Management Unit)
- SICAM T (Digital Measurement Device)
- SICAM SGU (Smart Grid Unit)
- **Versions:** All versions prior to the latest security updates (SICAM MMU/T v2.20 and SICAM SGU v1.40).
- **Configurations:** Systems with the web-based management interface enabled and accessible via the network.
## Vulnerability Description
The affected devices suffer from a complete lack of authentication in the default web interface. This allows unauthenticated attackers to:
1. **Firmware Tampering:** Upload and install malicious firmware images without any credentials, leading to total device compromise.
2. **Remote Code Execution (RCE):** Trigger memory corruption or command injection flaws within the web server to execute arbitrary code.
3. **Data Leakage:** Access sensitive configuration files, including plaintext or weakly encrypted passwords and network credentials.
## Exploitation
- **Status:** PoC concepts exist; vulnerabilities are known to be easily exploitable due to missing authentication.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Access to passwords and system configuration)
- **Integrity:** High (Ability to install unauthorized firmware/malicious code)
- **Availability:** High (Potential to brick devices or disrupt power monitoring)
## Remediation
### Patches
Siemens has released updates that introduce authentication mechanisms to the web application:
- **SICAM MMU / SICAM T:** Update to v2.20 or later.
- **SICAM SGU:** Update to v1.40 or later (Note: SGU is discontinued; this is a final security patch).
### Workarounds
As the vendor notes the patch may not mitigate all underlying flaws:
- **Network Segmentation:** Isolate the devices within a secure VLAN.
- **Access Control:** Disable the web interface if not required for operations.
- **VPN/Firewall:** Only allow access to the web interface via a secure VPN or an encrypted management tunnel.
- **Restrict IP Access:** Implement Access Control Lists (ACLs) to permit only specific administrative IP addresses.
## Detection
- **Indicators of Compromise:**
- Unusual reboots or device downtime.
- Unauthorized firmware version changes in device logs.
- Unexplained configuration changes or export requests in web server logs.
- **Detection Methods:** Monitor network traffic for HTTP POST requests to firmware update endpoints originating from unauthorized IP addresses.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-875865[.]pdf
- **CISA ICS Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-23-285-02