Full Report
A buffer overflow vulnerability in the integrated web server of multiple APOGEE and TALON automation devices could allow a remote attacker to execute arbitrary code on the devices with root privileges. Affected devices include the APOGEE MBC/MEC/PXC P2 Ethernet devices with Power Open Processors (PPC), APOGEE PXC BACnet devices, and TALON TC BACnet devices. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Siemens APOGEE and TALON Integrated Web Server Buffer Overflow
## CVE Details
- **CVE ID:** CVE-2017-9946
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
## Affected Systems
- **Products:**
- APOGEE MBC (P2 Ethernet)
- APOGEE MEC (P2 Ethernet)
- APOGEE PXC (P2 Ethernet)
- APOGEE PXC BACnet
- TALON TC BACnet
- **Versions:**
- All versions prior to those listed in the remediation section.
- **Configurations:** Devices must have the integrated web server enabled and be accessible via the network (typically via Power Open Processors/PPC).
## Vulnerability Description
A stack-based buffer overflow exists within the integrated web server of the affected Siemens building automation controllers. The flaw is triggered by the improper validation of input data sent to the web interface. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request to the device, leading to a memory corruption that allows for arbitrary code execution with root privileges.
## Exploitation
- **Status:** Publicly disclosed; no widespread exploitation in the wild reported at time of advisory.
- **Complexity:** Low (No authentication or user interaction required).
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to device data and configuration).
- **Integrity:** Total (Ability to modify device logic and system files).
- **Availability:** Total (Ability to crash the device or render it inoperable).
## Remediation
### Patches
Siemens has released the following updates to address the flaw:
- **APOGEE PXC BACnet (Compact/Modular):** Update to v3.5 or later.
- **TALON TC BACnet:** Update to v3.5 or later.
- **APOGEE PXC Series (P2):** Update to v2.8.
- *Note: Users should check the Siemens ProductCERT portal for the latest firmware specific to their hardware revision.*
### Workarounds
For devices where patches are not yet available or cannot be immediately applied:
- **Disable the Web Server:** Disable the integrated web server if it is not required for operation.
- **Network Segmentation:** Ensure the devices are not accessible via the Internet. Use VLANs to isolate building automation traffic from the corporate network.
- **VPN/Tunneling:** Use secure VPN tunnels for any remote access to the building automation network.
## Detection
- **Indicators of Compromise:** Unexpected reboots of the automation controller, unauthorized configuration changes, or anomalous HTTP traffic patterns directed at the device's management IP.
- **Detection Methods:**
- Monitor network traffic for malformed HTTP requests targeting the device’s web port (typically TCP 80/443).
- Use Industrial Control Systems (ICS) aware firewalls/IDS to identify and block exploit payloads.
## References
- **Siemens Security Advisory:** hxxps[://]www[.]siemens[.]com/cert/advisories/ssa-701859[.]pdf
- **ICS-CERT Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-17-229-01
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2017-9946