Full Report
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as “AMNESIA:33” vulnerabilities. The Siemens products mentioned below are affected by one of these vulnerabilities (CVE-2020-13988). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: AMNESIA:33 TCP/IP Stack Flaw in Siemens Products
## CVE Details
- **CVE ID:** CVE-2020-13988
- **CVSS Score:** 8.8 (High) - *Based on standard AMNESIA:33 scoring for this CVE*
- **CWE:** CWE-190 (Integer Overflow or Wraparound), CWE-125 (Out-of-bounds Read)
## Affected Systems
- **Products:** Various Siemens embedded devices utilizing affected open-source TCP/IP stacks (specifically the uIP stack).
- **Versions:** Multiple legacy and current versions. (Note: Specific product lists are subject to update by Siemens as assessment continues).
- **Configurations:** Devices with network services enabled that process incoming TCP/IP traffic using the vulnerable uIP stack.
## Vulnerability Description
CVE-2020-13988 is a vulnerability found in the **uIP open-source TCP/IP stack**. The flaw is an integer overflow that occurs when the stack parses certain IP options in incoming packets. Because the stack does not properly validate the length fields within these options, an attacker can trigger an out-of-bounds read or memory corruption. In the context of embedded devices, this typically leads to a Denial of Service (DoS) condition or, in some scenarios, the disclosure of sensitive information from the device's memory.
## Exploitation
- **Status:** PoC available (Publicly disclosed as part of the AMNESIA:33 research).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Low/Medium (Potential memory disclosure)
- **Integrity:** None
- **Availability:** High (Device crash or infinite loop leading to Denial of Service)
## Remediation
### Patches
Siemens has released updates for several affected product lines. Users are advised to:
- Consult the specific Siemens Security Advisory for their device model.
- Update to the latest firmware versions provided on the Siemens Support Portal.
### Workarounds
For products where updates are not yet available, Siemens recommends the following countermeasures:
- **Network Segmentation:** Minimize network exposure for all control system devices and ensure they are not accessible from the Internet.
- **Firewall Filtering:** Use firewalls to isolate the industrial network from the business network.
- **VPN:** Use secure methods, such as VPNs, if remote access is required.
- **Disable Unused Services:** Turn off any network services or protocols that are not required for operation.
## Detection
- **Indicators of Compromise:** Unusual device reboots, network interface unresponsiveness, or unexpected crashes of embedded services.
- **Detection methods and tools:**
- Use Deep Packet Inspection (DPI) to identify and drop malformed IP packets or packets with unusual IP options.
- Utilize IDS/IPS signatures specifically designed for AMNESIA:33 (CVE-2020-13988).
## References
- Siemens Security Advisory: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-434032[.]pdf
- Forescout Research (AMNESIA:33): hxxps[://]www[.]forescout[.]com/resources/amnesia33-how-tcp-ip-stacks-breed-vulnerabilities/
- NIST NVD: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2020-13988