Siemens issued a security advisory on Tuesday to alert users of its SIMATIC WinCC Sm@rtClient App for iOS of multiple privilege escalation vulnerabilities.
The security flaws could allow attackers to perform privilege escalation either against the Sm@rtClient iOS App or the servers the App is communicating with under certain conditions, Siemens said in its advisory.
The industrial products giant has released software updates for its iOS Apps, which fix a total of three vulnerabilities, all related to how the applications store and manage passwords.
Fortunately, in order to exploit the vulnerabilities an attacker must have physical access to the iOS device.
The vulnerabilities affect all versions of WinCC Sm@rtClient for iOS and WinCC Sm@rtClient Lite prior to version 1.0.2.
SIMATIC WinCC is used to monitor and control physical processes involved in industry and infrastructure, and is often used in industries such as oil and gas, chemical, food and beverage, water and wastewater.
Siemens credited Kim Schlyter, Seyton Bradford and Richard Warren from FortConsult for reporting the vulnerabilities summarized below:
• CVE-2014-5231 [CVSS Base Score 4.6] – The existing storage mechanism for the application specific password could allow attackers to extract the password and gain access to the application if local access is available.
• CVE-2014-5232 [CVSS Base Score 4.6] – In case an application specific password is set, the user would not be prompted to enter the password if the App was resumed from the background.
• CVE-2014-5233 [CVSS Base Score 4.6] – The implemented mechanism to process Sm@rtServer credentials could allow attackers to extract the credentials if local access is available.
The updated versions of Sm@rtClient and Sm@rtClient Lite should be downloaded via Apple’s App Store.
In November, Siemens released software updates to address two critical vulnerabilities in some of its SIMATIC WinCC products, one of which could be exploited remotely by an unauthenticated attacker.
In December, ICS-CERT warned that ongoing attacks levering the BlackEnergy malware were targeting critical infrastructure companies that use human-machine interface (HMI) products from various, including GE Cimplicity, Advantech/Broadwin WebAccess, and Siemens WinCC.
