Researchers have identified three vulnerabilities in Siemens’ SIMATIC HMI devices. The German engineering giant has started releasing software updates to address the security holes in affected products.
The most severe of the issues is a resource exhaustion vulnerability (CVE-2015-2822) that can be leveraged by an attacker positioned between the HMI panel and a programmable logic controller (PLC) to cause a denial-of-service (DoS) condition in the HMI panel. The flaw can be exploited by sending specially crafted packets on TCP port 102, ICS-CERT and Siemens explained in advisories.
The fact that a malicious actor can launch this kind of man-in-the-middle (MitM) attack by positioning himself on the network path between a PLC and its communication partner is a separate vulnerability that has been assigned the CVE identifier CVE-2015-1601. An attacker can leverage this vulnerability to intercept or modify industrial communications, Siemens said.
The third flaw is related to authentication (CVE-2015-2823). Researchers have discovered that users can authenticate themselves not just with the actual passwords, but with the password hashes as well.
“If attackers obtain password hashes for SIMATIC WinCC users, they could possibly use the hashes to authenticate themselves,” ICS-CERT explained.
The remotely exploitable vulnerabilities affect SIMATIC HMI Basic Panels (1st and 2nd generation), HMI Comfort Panels, WinCC Runtime Advanced, WinCC Runtime Professional, HMI Mobile Panels, HMI Multi Panels, NET PC-Software (V12 and V13), WinCC V7.x, and the SIMATIC Automation Tool. These products are used for controlling and monitoring machines and plants, communications between controllers and PC-based solutions, and controlling and monitoring physical processes.
Siemens has released updates for most of the impacted products. The company says it’s currently preparing patches for SIMATIC HMI Basic Panels 1st Generation, HMI Mobile Panel 277, and HMI Multi Panels.
Until the fixes become available, organizations are advised to apply defense-in-depth recommendations, use VPNs to protect network communications, and apply the cell protection concept described in Siemens’ operational guidelines for industrial security. Since two of the vulnerabilities can be exploited through port 102/TCP, ICE-CERT recommends blocking all external traffic to that port.
The MitM and resource exhaustion vulnerabilities were reported to Siemens by the Quarkslab team. The authentication bug was identified by Ilya Karpov of Positive Technologies.
Related: Learn More At the ICS Cyber Security Conference
Related: Siemens Fixes Vulnerabilities in Several ICS Products
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
Latest News
- Insider Q&A: Artificial Intelligence and Cybersecurity In Military Tech
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
