Full Report
Siemens low & high voltage power meters are affected by multiple security vulnerabilities due to the underlying Wind River VxWorks network stack. This stack is affected by eleven vulnerabilities known as the "URGENT/11". The vulnerability could allow an attacker to execute a variety of exploits for the purpose of Denial-of-Service (DoS), data extraction, RCE, etc. targeting both availability and confidentiality of the devices and data. Siemens is working on updates for the affected products, and recommends countermeasures until fixes are available.
Analysis Summary
# Vulnerability: URGENT/11 Vulnerabilities in Siemens Power Meters
## CVE Details
*Note: URGENT/11 consists of 11 distinct CVEs. The most critical are listed below.*
- **CVE-2019-12256:** CVSS 9.8 (Critical) - Stack overflow in the parsing of IPv4 options.
- **CVE-2019-12255:** CVSS 9.8 (Critical) - TCP Urgent Pointer 0 allocation issues.
- **CVE-2019-12260:** CVSS 9.8 (Critical) - TCP Urgent Pointer state confusion.
- **CVE-2019-12261:** CVSS 8.8 (High) - TCP Urgent Pointer remote code execution.
- **CVE-2019-12263:** CVSS 8.1 (High) - TCP Urgent Pointer state confusion.
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-20 (Improper Input Validation).
## Affected Systems
- **Products:**
- Siemens SENTRON PAC series (e.g., PAC3200, PAC4200)
- Siemens SICAM series (e.g., SICAM Q100, Q200, T)
- High voltage power meters and protection devices utilizing the VxWorks IPnet stack.
- **Versions:** All versions using Wind River VxWorks prior to the specific security patches issued in response to URGENT/11.
- **Configurations:** Devices with the TCP/IP stack enabled and connected to a network reachable by an attacker.
## Vulnerability Description
The vulnerability stems from the **IPnet TCP/IP stack** integrated into the Wind River VxWorks Real-Time Operating System (RTOS). These flaws reside in the way the network stack handles specific TCP/IP packets. The "URGENT/11" includes bugs in the handling of TCP options (specifically the Urgent Pointer), DHCP client responses, and IGMP parsing. Because these vulnerabilities exist at the stack level, an attacker can trigger them by sending specially crafted packets without requiring any user interaction or authentication.
## Exploitation
- **Status:** PoC available; widely documented by security researchers (Armis).
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (Remote). The attacker needs network access to the target device's IP stack.
## Impact
- **Confidentiality:** High (Potential for data extraction).
- **Integrity:** High (Potential for Remote Code Execution (RCE) and system takeover).
- **Availability:** High (Can lead to Denial-of-Service (DoS) and device crashes in critical infrastructure).
## Remediation
### Patches
- Siemens is actively releasing firmware updates for affected SENTRON and SICAM product lines.
- **Action:** Check the Siemens ProductCERT portal for specific firmware versions corresponding to your device hardware revision.
### Workarounds
- **Network Segmentation:** Isolate affected power meters into a dedicated VLAN with strictly controlled access.
- **Firewall Filtering:** Block unsolicited TCP traffic with "Urgent" flags or unusual IP options at the network perimeter.
- **Disable Unnecessary Services:** Disable any network services on the devices that are not required for operation to reduce the attack surface.
## Detection
- **Indicators of compromise:** Unexpected device reboots, loss of network connectivity, or unauthorized configuration changes.
- **Detection methods and tools:**
- Use Intrusion Detection Systems (IDS) with signatures specifically tuned for URGENT/11 (e.g., Snort/Suricata rules detecting malformed TCP options).
- Asset discovery tools to identify devices running vulnerable VxWorks versions.
## References
- Siemens ProductCERT: hxxps[://]www[.]siemens[.]com/cert/advisories
- Wind River Security Advisory: hxxps[://]www[.]windriver[.]com/security/announcements/tcp-ip-network-stack-vulnerabilities--urgent11/
- CISA Advisory (ICSA-19-211-01): hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-19-211-01