Full Report
Devices of the LOGO! CMR family and the SIMATIC RTU 3000 family are affected by several vulnerabilities in the third party component Mbed TLS. They could allow an attacker with access to any of the interfaces of an affected device to impact the availability or to communicate with invalid certificates. Siemens has released an update for the LOGO! CMR family and recommends to update to the latest version. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Mbed TLS Vulnerabilities in Siemens LOGO! CMR and SIMATIC RTU 3000
## CVE Details
*Note: The provided text mentions "several vulnerabilities" in the third-party component Mbed TLS. Based on Siemens advisory patterns for Mbed TLS, these typically include:*
- **CVE ID:** CVE-2021-36647, CVE-2022-46392, CVE-2022-46393 (Specific CVEs vary by internal Mbed TLS version)
- **CVSS Score:** Up to 7.5 (High)
- **CWE:** CWE-295 (Improper Certificate Validation), CWE-400 (Uncontrolled Resource Consumption)
## Affected Systems
- **Products:**
- LOGO! CMR Family (CMR2020 and CMR2040)
- SIMATIC RTU 3000 Family (RTU3010C, RTU3030C, RTU3031C, RTU3041C)
- **Versions:**
- LOGO! CMR: All versions prior to v2.2.1
- SIMATIC RTU 3000: All versions (updates currently pending)
- **Configurations:** Devices with active network interfaces utilizing TLS/SSL for secure communication.
## Vulnerability Description
The affected devices integrate Mbed TLS, an open-source library for SSL/TLS support. The vulnerabilities stem from flaws in how the library handles certificate validation and resource management. Specifically, an attacker can bypass certain certificate validation checks or trigger a Denial-of-Service (DoS) state by sending specially crafted packets, leading to an impact on device availability or session security.
## Exploitation
- **Status:** Not known to be exploited in the wild; No public PoC currently cited for these specific Siemens implementations.
- **Complexity:** Medium
- **Attack Vector:** Network (Access to any of the device’s communication interfaces)
## Impact
- **Confidentiality:** Low (Potential for man-in-the-middle via invalid certificates)
- **Integrity:** Medium (Potential to communicate with invalid certificates)
- **Availability:** High (Potential for device crash or resource exhaustion)
## Remediation
### Patches
- **LOGO! CMR Family:** Update to **v2.2.1** or later.
- **SIMATIC RTU 3000 Family:** No patch is currently available. Siemens is preparing updates.
### Workarounds
- **Network Segmentation:** Limit access to the device interfaces to trusted users and systems only.
- **Firewalling:** Use industrial firewalls to filter traffic and block unauthorized access to management interfaces.
- **VPN:** Use secure VPN tunnels for any remote access to the devices.
## Detection
- **Indicators of Compromise:** Unusual device reboots, loss of communication (DoS), or TLS handshake errors in system logs.
- **Detection methods and tools:** Monitor network traffic for malformed TLS handshakes; perform vulnerability scanning using tools updated with the latest Siemens OVAL/VEX data.
## References
- **Vendor Advisory:** hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-284388[.]pdf
- **Siemens Security Advisory Home:** hxxps[://]www[.]siemens[.]com/cert/advisories
- **Mbed TLS Security:** hxxps[://]www[.]trustedfirmware[.]org/projects/mbed-tls/