Siemens informed customers this week that its SINUMERIK controllers are affected by denial-of-service (DoS), privilege escalation and code execution vulnerabilities, including several flaws that have been classified as “critical.”
Researchers at Kaspersky Lab discovered that SINUMERIK 808D, 828D and 840D controllers – some of which have been discontinued – are affected by ten vulnerabilities.
The most serious of the flaws, based on its CVSS score of 10, is CVE-2018-11466, which allows an attacker on the network to cause a DoS condition on the integrated software firewall or execute arbitrary code in the context of the firewall by sending specially crafted packets to TCP port 102. The security hole can be exploited by an unauthenticated attacker with no user interaction.
Another critical flaw, CVE-2018-11457, affects the integrated web server and it can be exploited by a network attacker with access to TCP port 4842 to execute code with elevated privileges by sending specially crafted packets. However, Siemens noted that exploitation is only possible if the port is manually opened in the firewall configuration.
The integrated VNC server is also affected by a critical vulnerability that allows arbitrary code execution with elevated privileges via specially crafted network packets, this time on port 5900. This security hole is tracked as CVE-2018-11458.
The last critical flaw identified by Kaspersky researchers in SINUMERIK controllers is CVE-2018-11462, which can be exploited to elevate privileges, but not to root.
Siemens also said its controllers are impacted by three high-severity flaws that allow local code execution, and three medium-severity bugs that can be exploited for privilege escalation and DoS attacks.
Learn More About ICS Vulnerabilities at SecurityWeek’s ICS Cyber Security Conference
Experts noted recently that CVSS scores can be misleading for ICS vulnerabilities and advised organizations not to prioritize patching based only on CVSS scores. In the case of these SINUMERIK controller vulnerabilities, several of them are critical based on their CVSS score, but many of them have mitigating factors. Furthermore, DoS vulnerabilities can pose a more serious risk in the case of industrial systems compared to privilege escalation or code execution flaws.
Siemens says it’s not aware of malicious exploits for any of these vulnerabilities. Patches and/or mitigations have been released by the German industrial giant for each of the impacted controllers.
Siemens also informed customers this week that its TIM 1531 IRC modules are missing proper authentication mechanisms when connecting on TCP port 102.
The company announced recently its intention to release security advisories on the second Tuesday of every month, similar to Microsoft, Adobe and SAP.
Related: Flaws in Siemens Tool Put ICS Environments at Risk
Related: Many Siemens Products Affected by Foreshadow Vulnerabilities