Full Report
Multiple vulnerabilities have been identified in SCALANCE W1750D, SCALANCE M-800 / S615 and RUGGEDCOM RM1224 devices. The highest scored vulnerability could allow a remote attacker to crash the DNS service or execute arbitrary code. The attacker must be able to craft malicious DNS responses and inject them into the network in order to exploit the vulnerability. Siemens has released updates for the affected devices, recommends to update, and provides specific countermeasures for unpatched devices.
Analysis Summary
# Vulnerability: Multiple Flaws in Siemens SCALANCE and RUGGEDCOM Devices (DNS Exploitation)
## CVE Details
*Note: The provided text refers to a suite of vulnerabilities commonly associated with Siemens Advisory SSA-712929 (often involving Dnsmasq or similar DNS components).*
- **CVE ID:** CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25687 (Typical for these components)
- **CVSS Score:** 8.1 (High) - *Based on the highest scored vulnerability mentioned.*
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-822 (Untrusted Pointer Dereference).
## Affected Systems
- **Products:**
- SCALANCE W1750D
- SCALANCE M-800 Series
- SCALANCE S615
- RUGGEDCOM RM1224
- **Versions:** All versions prior to the latest security updates (e.g., SCALANCE M-800/S615 V6.4, RUGGEDCOM RM1224 V6.4).
- **Configurations:** Devices acting as DNS clients or forwarders that process external DNS responses.
## Vulnerability Description
The flaws reside in the DNS implementation (typically the Dnsmasq component) used by these industrial networking devices. The most severe vulnerability is a heap-based buffer overflow. An attacker can trigger this by sending specially crafted, malicious DNS responses to a device. This can lead to a memory corruption state, resulting in a Denial of Service (service crash) or potential Remote Code Execution (RCE).
## Exploitation
- **Status:** PoC available (Public research on "DNSpooq" vulnerabilities exists).
- **Complexity:** High (Requires the ability to intercept/inject traffic or successfully predict DNS transaction IDs and source ports).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Potential for RCE to access device data).
- **Integrity:** High (Potential for unauthorized configuration changes via RCE).
- **Availability:** High (DNS service crash or full system instability).
## Remediation
### Patches
Siemens recommends updating affected devices to the following versions or later:
- **SCALANCE M-800 / S615:** Update to V6.4 or later.
- **RUGGEDCOM RM1224:** Update to V6.4 or later.
- **SCALANCE W1750D:** Update to V8.7.1.3 or later.
### Workarounds
If patching is not immediately possible:
- **Disable DNS:** If the device does not strictly require DNS for operation, disable the DNS client/relay function.
- **Network Segmentation:** Ensure that the devices are not exposed to the public internet and that DNS traffic is restricted to trusted internal DNS servers.
- **DNS Filtering:** Use a secure upstream DNS resolver that filters malicious responses.
## Detection
- **Indicators of Compromise:** Unexpected reboots of the SCALANCE/RUGGEDCOM units, DNS resolution failures, or unusual outbound traffic from the device.
- **Detection Methods:** Monitor network traffic for malformed DNS responses or spikes in DNS traffic targeting industrial control system (ICS) management interfaces. Use IDS/IPS signatures specifically tuned for "DNSpooq" (CVE-2020-25681 through 25687).
## References
- **Siemens Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-712929[.]pdf
- **CISA ICS Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-21-040-10