Siemens has released firmware updates for some of its SIPROTEC products to address several medium severity vulnerabilities that can be exploited to bypass authentication and cause a denial-of-service (DoS) condition.
Kaspersky Lab researchers Kirill Nesterov and Anatoly Katushin informed Siemens that its SIPROTEC 4 and SIPROTEC Compact devices are plagued by a flaw that can be exploited by an attacker with network access to bypass authentication mechanisms and perform administrative operations (CVE-2016-7112).
Nesterov and Katushin also discovered that an attacker can cause these devices to enter defect mode (DoS condition) by sending them specially crafted packets via Port 80/TCP (CVE-2016-7113).
Siemens also discovered a security hole similar to CVE-2016-7112, which allows an attacker with network access to bypass authentication and conduct administrative operations while a legitimate user is logged in to the web interface. This issue is tracked as CVE-2016-7114.
The vendor addressed the flaws by updating the firmware of the optional EN100 Ethernet module for SIPROTEC 4 and SIPROTEC Compact to version 4.29. In addition to applying the updates, Siemens advises customers to use firewalls, network segmentation and VPNs to protect critical systems against potential attacks.
SIPROTEC products are protection relays that provide control, protection, measurement and automation functions for electrical substations. The optional Ethernet modules allow these devices to communicate with electrical or optical 100 Mbps interfaces.
ICS-CERT’s website shows that this is the third round of security updates released by Siemens for its SIPROTEC products in the past years. In July 2015, the company released version 4.25 for the EN100 module to address a high severity DoS vulnerability. Earlier this year, the EN100 firmware was again updated to patch a couple of information exposure issues identified by researchers from Kaspersky and HackerDom.
Related Reading: The Top 3 Threats to Industrial Control Systems
Related Reading: Air Gap or Not, Why ICS/SCADA Networks Are at Risk
Related Reading: Siemens Patches Flaws in Industrial Automation Products
