Full Report
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as “AMNESIA:33” vulnerabilities. This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-2020-17437) to Siemens products. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available. The impact of another “AMNESIA:33” vulnerability (CVE-2020-13988) is described in Siemens Security Advisory SSA-541017.
Analysis Summary
# Vulnerability: AMNESIA:33 TCP/IP Stack Flaws in Siemens Products
## CVE Details
- **CVE ID:** CVE-2020-13987
- **CVSS Score:** 6.5 (Medium)
- **CWE:** CWE-190 (Integer Overflow or Wraparound)
- **CVE ID:** CVE-2020-17437
- **CVSS Score:** 6.5 (Medium)
- **CWE:** CWE-822 (Untrusted Pointer Dereference)
## Affected Systems
- **Products:**
- SIMATIC CP 1543-1
- SIMATIC CP 1545-1
- SINAMICS DCP
- SINAMICS G120, G130, G150
- SINAMICS S120, S150
- SINUMERIK 840D sl
- **Versions:** All versions prior to those listed in the Remediation section.
- **Configurations:** Devices utilizing affected open-source TCP/IP stacks for network communication.
## Vulnerability Description
These vulnerabilities exist in the open-source TCP/IP stacks (specifically the uIP stack) used by embedded devices.
- **CVE-2020-13987:** An integer overflow in the calculation of the TCP segment length leads to an out-of-bounds read. This occurs when the stack processes specially crafted TCP packets.
- **CVE-2020-17437:** An untrusted pointer dereference flaw. If a device receives a malformed packet, the stack may attempt to access a memory location via an unverified pointer, leading to a crash or undefined behavior.
## Exploitation
- **Status:** PoC available (Publicly disclosed as part of the AMNESIA:33 research). No widespread exploitation in the wild reported specifically for these Siemens implementations at the time of the advisory.
- **Complexity:** Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Low (Possible information leakage via out-of-bounds read)
- **Integrity:** None
- **Availability:** High (Denial of Service via device crash or reboot)
## Remediation
### Patches
Siemens has released several firmware updates to address these flaws:
- **SIMATIC CP 1543-1:** Update to v3.0.22 or later.
- **SIMATIC CP 1545-1:** Update to v1.1 or later.
- **SINAMICS S120:** Update to v5.2 SP3 HF6 or later.
- *Note: Users should consult the Siemens ProductCERT portal for the most recent version specific to their hardware variant.*
### Workarounds
For products where updates are not yet available or cannot be applied:
- Disable unnecessary network services and protocols.
- Restrict network access to affected devices using firewalls or VLANs.
- Implement the principle of least privilege for network connectivity.
- Use VPNs for any remote maintenance traffic.
## Detection
- **Indicators of compromise:** Frequent, unexplained reboots of the communication processor (CP) or network interface cards.
- **Detection methods and tools:**
- Use Intrusion Detection Systems (IDS) to monitor for malformed TCP packets or unusual TCP segment lengths.
- Monitor system logs for memory access errors or stack trace reports.
## References
- **Siemens Security Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-434032[.]pdf
- **Forescout AMNESIA:33 Research:** hxxps[://]www[.]forescout[.]com/blog/amnesia33-how-tcp-ip-stacks-make-millions-of-ot-iot-and-it-devices-vulnerable/
- **Siemens SSA-541017 (Related):** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-541017[.]pdf