Full Report
Security researchers discovered and disclosed 14 vulnerabilities in the Interniche IP stack, also known as “INFRA:HALT” vulnerabilities [0]. This advisory describes the impact to Siemens low voltage products, which are only affected by four out of the 14 vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. [0] https://www.forescout.com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
Analysis Summary
# Vulnerability: INFRA:HALT Vulnerabilities in Siemens Low Voltage Products
## CVE Details
- **CVE ID:** CVE-2020-25927, CVE-2021-31226, CVE-2021-31227, CVE-2021-31228
- **CVSS Score:**
- CVE-2020-25927: 9.8 (Critical)
- CVE-2021-31226: 9.1 (Critical)
- CVE-2021-31227: 7.5 (High)
- CVE-2021-31228: 9.8 (Critical)
- **CWE:** CWE-120 (Buffer Overflow), CWE-190 (Integer Overflow), CWE-119 (Memory Corruption)
## Affected Systems
- **Products:**
- SENTRON PAC3200
- SENTRON PAC4200
- COM100/COM800 (Breaker communication modules)
- **Versions:** All versions prior to the latest released patches (see Remediation).
- **Configurations:** Devices with Ethernet/IP interfaces utilizing the Interniche (NicheStack) TCP/IP stack.
## Vulnerability Description
The "INFRA:HALT" series consists of flaws in the Interniche IP stack. Specifically for Siemens low voltage products:
- **DNS Client Vulnerabilities:** Improper validation of DNS responses can lead to heap-based buffer overflows (CVE-2020-25927).
- **HTTP Server Vulnerabilities:** Flaws in the integrated HTTP server's handling of POST requests and header data can result in integer overflows and heap-based buffer overflows (CVE-2021-31226, CVE-2021-31227, CVE-2021-31228).
These flaws allow an attacker to execute arbitrary code or cause a Denial of Service (DoS) by sending specially crafted packets.
## Exploitation
- **Status:** Proof of Concept (PoC) available; researchers have demonstrated Remote Code Execution (RCE) on affected stacks.
- **Complexity:** Low to Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Potential for data exfiltration or credential theft)
- **Integrity:** High (Potential for unauthorized configuration changes or firmware manipulation)
- **Availability:** High (Device crash, reboot loops, or total loss of communication)
## Remediation
### Patches
Siemens recommends updating to the following versions:
- **SENTRON PAC3200:** Update to V2.4.6 or later
- **SENTRON PAC4200:** Update to V2.3.2 or later
- **COM100/COM800:** Update to V4.4.1 or later
### Workarounds
If patches cannot be applied immediately:
- **Disable Unnecessary Services:** Disable the HTTP/HTTPS server if not required for operations.
- **Network Segmentation:** Isolate affected devices from the corporate network and the internet. Use a firewall to restrict access to management ports (e.g., TCP/80, TCP/443).
- **DNS Security:** Configure devices to point to trusted DNS servers only and restrict DNS traffic to authorized resolvers.
## Detection
- **Indicators of Compromise:** Unusual device reboots, loss of communication with SCADA/BMS systems, or unexpected HTTP traffic directed at the devices.
- **Detection methods and tools:**
- Use the Forescout "project-memoria-detector" script available on GitHub to scan for vulnerable NicheStack instances.
- Monitor network traffic for malformed DNS responses or abnormally long HTTP POST requests targeting embedded devices.
## References
- **Siemens Security Advisory:** hxxps://cert-portal.siemens[.]com/productcert/pdf/ssa-496229.pdf
- **Forescout Research:** hxxps://www.forescout[.]com/blog/new-critical-operational-technology-vulnerabilities-found-on-nichestack/
- **ICS-CERT Advisory:** hxxps://www.cisa[.]gov/news-events/ics-advisories/icsa-21-217-01