Full Report
The advisory informs about multiple vulnerabilities in the Central Control Server (CCS) application, as initially reported in SSA-761617 on 2019-12-10 and SSA-844761 on 2020-03-10. The vulnerabilities involve authentication bypass (CVE-2019-18337, CVE-2019-18341), path traversal (CVE-2019-18338, CVE-2019-19290), information disclosure (CVE-2019-13947, CVE-2019-18340, CVE-2019-19291), privilege escalation (CVE-2019-18342), SQL injection (CVE-2019-19292), cross-site scripting (CVE-2019-19293, CVE-2019-19294), and insufficient logging (CVE-2019-19295). PKE has released an update for CCS that fixes the reported vulnerabilities, except for CVE-2019-18340. For details see the PKE Security Advisory at https://sivms.cloud/wp-content/uploads/2021/03/sivms-cve-fixes_1.0_EN.pdf Siemens recommends to update to the latest version and recommends specific countermeasures to mitigate the vulnerabilities.
Analysis Summary
# Vulnerability: Multiple Flaws in PKE Central Control Server (CCS)
## CVE Details
*Note: Due to the high volume of CVEs in this advisory, the most critical impacts are highlighted below.*
* **Authentication Bypass:** CVE-2019-18337, CVE-2019-18341
* **Path Traversal:** CVE-2019-18338, CVE-2019-19290
* **Information Disclosure:** CVE-2019-13947, CVE-2019-18340, CVE-2019-19291
* **Privilege Escalation:** CVE-2019-18342
* **SQL Injection:** CVE-2019-19292
* **Cross-Site Scripting (XSS):** CVE-2019-19293, CVE-2019-19294
* **Insufficient Logging:** CVE-2019-19295
* **CVSS Scores:** Ranging from **Medium to Critical** (Specific scores vary by CVE; Auth Bypass and SQLi typically range 8.8–9.8).
## Affected Systems
* **Products:** Central Control Server (CCS) application (PKE/Siemens integrated environments).
* **Versions:** All versions prior to the remediation release referenced in March 2021.
* **Configurations:** Systems with web-facing interfaces or those accessible via internal management networks.
## Vulnerability Description
The Central Control Server (CCS) suffers from a broad spectrum of security flaws:
* **Broken Authentication:** Flaws in session management allow attackers to bypass login requirements.
* **Input Validation Issues:** Multiple vectors for SQL Injection and Path Traversal exist, allowing for unauthorized database queries and arbitrary file access on the host system.
* **Client-Side Risks:** XSS vulnerabilities allow for the execution of malicious scripts in the context of a user's browser session.
* **Sensitive Data Exposure:** Improper handling of system information and insufficient logging (CVE-2019-19295) hinders forensic auditing and exposes configuration details.
## Exploitation
* **Status:** Publicly disclosed (originally reported 2019/2020).
* **Complexity:** Low to Medium.
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** High (Information disclosure and database access).
* **Integrity:** High (Unauthorized system changes and SQL manipulation).
* **Availability:** Medium to High (Depending on the extent of SQL injection or file system access).
## Remediation
### Patches
* **PKE Update:** A comprehensive update for CCS has been released by PKE that addresses all reported vulnerabilities **except for CVE-2019-18340**.
* **Action:** Users should upgrade to the latest version of the CCS application immediately.
### Workarounds
* **Network Segmentation:** Restrict access to the CCS application to authorized personnel and management VLANs only.
* **CVE-2019-18340 Mitigation:** As this remains unpatched in some versions, ensure strict access control and monitor for unusual information retrieval patterns.
* **Defense-in-Depth:** Deploy Web Application Firewalls (WAF) to filter SQLi and XSS patterns.
## Detection
* **Indicators of Compromise:** Unusual administrative logins from unknown IP addresses; directory traversal strings (`../`) in web server logs; suspicious SQL syntax in application logs.
* **Detection methods:** Vulnerability scanners updated with 2019/2020 Siemens/PKE definitions; log analysis for failed or bypassed authentication events.
## References
* Siemens Security Advisory SSA-761617
* Siemens Security Advisory SSA-844761
* PKE Security Advisory: hxxps[://]sivms[.]cloud/wp-content/uploads/2021/03/sivms-cve-fixes_1.0_EN.pdf