Full Report
A vulnerability has been identified in the OPC Foundation Local Discovery Server (LDS) [0] of several industrial products. The vulnerability could cause a denial of service condition on the service or the device. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available. [0] https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142.pdf
Analysis Summary
# Vulnerability: Denial of Service in OPC Foundation Local Discovery Server (LDS)
## CVE Details
- **CVE ID:** CVE-2021-40142
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-20 (Improper Input Validation) / CWE-617 (Reachable Assertion)
## Affected Systems
- **Products:** Siemens industrial products utilizing the OPC Foundation Local Discovery Server (LDS). Key affected product families include:
* SIMATIC NET PC Software
* SIMATIC S7-1500 CPU Families
* SINUMERIK 840D sl
* SIMOTION
- **Versions:**
* All versions of OPC Foundation LDS prior to V1.04.402.
* Specific Siemens firmware versions (refer to Siemens Security Advisory SSA-321295 for exhaustive versioning).
- **Configurations:** Systems where the OPC UA Local Discovery Server is enabled and exposed to the network.
## Vulnerability Description
The vulnerability exists due to improper validation of user-supplied input within the OPC Foundation Local Discovery Server. Specifically, the server fails to correctly handle certain malformed OPC UA Discovery Service requests. A remote, unauthenticated attacker can send a specially crafted sequence of packets that triggers a reachable assertion or an infinite loop/crash, resulting in a Denial of Service (DoS) condition. Because the LDS often shares resources with the host industrial device, the impact may extend from the service itself to the entire device's responsiveness.
## Exploitation
- **Status:** PoC available (publicly documented in security research community). No confirmed reports of widespread exploitation in the wild at the time of publication.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Full service/device interruption)
## Remediation
### Patches
Siemens has released updates for several product lines. Users are advised to migrate to the following or later versions:
- **SIMATIC NET PC Software v16:** Update to V16 SP1 Update 6
- **SIMATIC NET PC Software v17:** Update to V17 SP1
- **OPC Foundation LDS:** Update to V1.04.402 or higher
### Workarounds
For products where updates are not yet available:
- **Disable LDS:** Disable the Local Discovery Server if not required for operations.
- **Network Segmentation:** Use firewalls to restrict access to the OPC UA Discovery port (default TCP 4840) to trusted internal nodes only.
- **Defense-in-Depth:** Implement VPNs for remote access to industrial networks to prevent external exposure.
## Detection
- **Indicators of Compromise:**
* Unexpected crashing or restarting of the `discovery.exe` process (or equivalent service).
* High CPU utilization on the industrial controller or PC host specifically tied to the LDS service.
- **Detection methods:**
* Monitor network traffic for malformed OPC UA `FindServers` or `GetEndpoints` requests.
* Use industrial IDS/IPS signatures specifically designed to identify CVE-2021-40142 exploitation attempts.
## References
- Siemens Security Advisory SSA-321295: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-321295[.]pdf
- OPC Foundation Security Bulletin: hxxps[://]files[.]opcfoundation[.]org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142[.]pdf
- NIST NVD: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2021-40142