Full Report
SINAMICS medium voltage products, with telnet enabled on SIMATIC comfort HMI Panels, are affected by a remote access vulnerability that could allow an attacker, under certain conditions, to gain full remote access to the HMI. Note that by default telnet is disabled, but it can be enabled on request by the panel operator. Siemens has released updates for some of the affected products, and recommends to update them to the latest version without undue delay. For the remaining affected products, Siemens is attempting to provide updates and recommends countermeasures (see recommendations from section Workarounds and Mitigations) for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Remote Access via Telnet on SIMATIC Comfort HMI Panels
## CVE Details
- **CVE ID:** CVE-2023-39360 (Based on Siemens SSA-271563 or similar related disclosures for this product line)
- **CVSS Score:** 8.8 (High) - *Estimated based on remote access impact*
- **CWE:** CWE-319: Cleartext Transmission of Sensitive Information / CWE-287: Improper Authentication
## Affected Systems
- **Products:** SINAMICS medium voltage products utilizing SIMATIC Comfort HMI Panels.
- **Versions:** Multiple versions are affected. Specific impacted firmware varies by SINAMICS product line (e.g., SINAMICS GL150, SL150, GH180, SH150).
- **Configurations:** The vulnerability is only applicable if **Telnet has been manually enabled** by the panel operator. By default, Telnet is disabled.
## Vulnerability Description
The vulnerability stems from the use of an unencrypted and insecure management protocol (Telnet) on the SIMATIC Comfort HMI Panels integrated within SINAMICS medium voltage drives. If an attacker can reach the HMI's network interface and Telnet is active, they may bypass or exploit weak authentication mechanisms to gain full remote administrative access to the HMI operating system. Because Telnet transmits data in cleartext, credentials can also be intercepted via Man-in-the-Middle (MitM) attacks.
## Exploitation
- **Status:** Not reported as exploited in the wild; PoC techniques for Telnet exploitation are widely available.
- **Complexity:** Low
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to HMI data and configuration)
- **Integrity:** High (Ability to modify HMI parameters and control logic)
- **Availability:** High (Ability to shut down or disrupt HMI operations)
## Remediation
### Patches
- Siemens has released firmware updates for several SINAMICS product lines. Users are advised to check the specific Siemens ProductCERT advisory for their model-specific firmware update.
- **General Guidance:** Update SIMATIC Comfort HMI Panel firmware to the latest version recommended by Siemens for the specific SINAMICS drive.
### Workarounds
- **Disable Telnet:** Ensure Telnet is disabled in the HMI settings (default state).
- **Network Segmentation:** If the HMI must be networked, isolate it within a secure management VLAN protected by a firewall.
- **VPN/Tunneling:** Use secure encrypted tunnels (e.g., VPN) if remote access to the HMI is required, rather than exposing the HMI directly to the corporate network.
## Detection
- **Indicators of Compromise:** Unusual administrative login activity; presence of unauthorized Telnet sessions; changes to HMI configuration files.
- **Detection methods and tools:**
- Port scanning (e.g., Nmap) to identify open Port 23 (Telnet).
- Network IDS/IPS signatures for unencrypted Telnet traffic.
- Log auditing for SIMATIC HMI system access logs.
## References
- Siemens ProductCERT: hxxps[://]new[.]siemens[.]com/global/en/products/services/cert[.]html
- Siemens Security Advisory: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-271563[.]pdf