CONFERENCE On Demand: Cyber AI & Automation Summit - Watch Now
Connect with us

Hi, what are you looking for?



Siemens Patches Several Critical Flaws in SINUMERIK Controllers

Siemens informed customers this week that its SINUMERIK controllers are affected by denial-of-service (DoS), privilege escalation and code execution vulnerabilities, including several flaws that have been classified as “critical.”

Siemens informed customers this week that its SINUMERIK controllers are affected by denial-of-service (DoS), privilege escalation and code execution vulnerabilities, including several flaws that have been classified as “critical.”

Researchers at Kaspersky Lab discovered that SINUMERIK 808D, 828D and 840D controllers – some of which have been discontinued – are affected by ten vulnerabilities.

The most serious of the flaws, based on its CVSS score of 10, is CVE-2018-11466, which allows an attacker on the network to cause a DoS condition on the integrated software firewall or execute arbitrary code in the context of the firewall by sending specially crafted packets to TCP port 102. The security hole can be exploited by an unauthenticated attacker with no user interaction. Critical vulnerabilities found in Siemens SINUMERIK controllers

Another critical flaw, CVE-2018-11457, affects the integrated web server and it can be exploited by a network attacker with access to TCP port 4842 to execute code with elevated privileges by sending specially crafted packets. However, Siemens noted that exploitation is only possible if the port is manually opened in the firewall configuration.

The integrated VNC server is also affected by a critical vulnerability that allows arbitrary code execution with elevated privileges via specially crafted network packets, this time on port 5900. This security hole is tracked as CVE-2018-11458.

The last critical flaw identified by Kaspersky researchers in SINUMERIK controllers is CVE-2018-11462, which can be exploited to elevate privileges, but not to root.

Siemens also said its controllers are impacted by three high-severity flaws that allow local code execution, and three medium-severity bugs that can be exploited for privilege escalation and DoS attacks.

Learn More About ICS Vulnerabilities at SecurityWeek’s ICS Cyber Security Conference

Experts noted recently that CVSS scores can be misleading for ICS vulnerabilities and advised organizations not to prioritize patching based only on CVSS scores. In the case of these SINUMERIK controller vulnerabilities, several of them are critical based on their CVSS score, but many of them have mitigating factors. Furthermore, DoS vulnerabilities can pose a more serious risk in the case of industrial systems compared to privilege escalation or code execution flaws.

Advertisement. Scroll to continue reading.

Siemens says it’s not aware of malicious exploits for any of these vulnerabilities. Patches and/or mitigations have been released by the German industrial giant for each of the impacted controllers.

Siemens also informed customers this week that its TIM 1531 IRC modules are missing proper authentication mechanisms when connecting on TCP port 102.

The company announced recently its intention to release security advisories on the second Tuesday of every month, similar to Microsoft, Adobe and SAP.

Related: Flaws in Siemens Tool Put ICS Environments at Risk

Related: Many Siemens Products Affected by Foreshadow Vulnerabilities

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.