Full Report
SIMATIC CM 1542-1, SCALANCE SC600 family and SIMATIC CP 343-1 Advanced devices are vulnerable to a vulnerability in the third party component libcurl that could allow an attacker to cause a Denial-of-Service condition on the affected devices. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. The impact of additional libcurl vulnerabilities is described in Siemens Security Advisory SSA-436177.
Analysis Summary
# Vulnerability: libcurl Denial-of-Service in Siemens Industrial Devices
## CVE Details
* **CVE ID:** CVE-2023-27536 (Associated with libcurl)
* **CVSS Score:** 5.3 (Medium)
* **CWE:** CWE-400: Uncontrolled Resource Consumption
## Affected Systems
* **Products:**
* SIMATIC CM 1542-1
* SCALANCE SC600 Family (SC622-2C, SC632-2C, SC636-2C, SC642-2C, SC646-2C)
* SIMATIC CP 343-1 Advanced
* **Versions:** All versions prior to the recommended patch releases.
* **Configurations:** Devices utilizing affected libcurl components for network communication.
## Vulnerability Description
A vulnerability exists in the third-party component **libcurl** (specifically related to GSS-API authentication in certain versions). When libcurl is used to connect to a malicious or misconfigured server, it may fail to properly manage resource allocation or connection reuse, leading to a **Denial-of-Service (DoS)** condition. In the context of Siemens industrial hardware, this results in the communication module becoming unresponsive, potentially disrupting industrial control processes.
## Exploitation
* **Status:** No known reports of exploitation in the wild for these specific Siemens implementations.
* **Complexity:** Low to Medium.
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** None
* **Integrity:** None
* **Availability:** **High** (The primary impact is the loss of device availability and communication capabilities).
## Remediation
### Patches
Siemens has released the following updates to address the libcurl vulnerabilities:
* **SCALANCE SC600 Family:** Update to V3.0 or later.
* **SIMATIC CM 1542-1:** Update to V3.0.42 or later.
* **SIMATIC CP 343-1 Advanced:** Refer to specific product support pages for latest firmware updates.
### Workarounds
For products where updates are not yet applied or available, Siemens recommends:
1. **Network Segmentation:** Protect affected devices with a firewall and isolate them from the internet/untrusted networks.
2. **Defense-in-Depth:** Implement the Siemens Industrial Security concept, ensuring devices are only accessible via VPN or secure internal gateways.
3. **Restrict Access:** Use Access Control Lists (ACLs) to limit communication to known-good endpoints.
## Detection
* **Indicators of Compromise:** Unexpected device reboots, loss of network connectivity to the CM/CP modules, or timeouts when attempting to access the device web interface.
* **Detection Methods:** Monitor network traffic for unusual or malformed GSS-API/Kerberos authentication attempts directed at the controller communication modules.
## References
* Siemens Security Advisory: [https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf] (SSA-436177)
* Siemens Product Support: [https://support.industry.siemens.com/]
* cURL Security: [https://curl.se/docs/security.html]