Detections
Analytics

Siemens PROFINET Stack Integrated on Interniche Stack Uncontrolled Resource Consumption (CVE-2022-25622)

high Tenable OT Security Plugin ID 500641

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability has been identified in SIMATIC CFU DIQ (All versions), SIMATIC CFU PA (All versions), SIMATIC S7-1500 CPU family (incl.
related ET200 CPUs and SIPLUS variants) (All versions < V2.0.0), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.10), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions), SIMATIC TDC CP51M1 (All versions), SIMATIC TDC CPU555 (All versions), SIMATIC WinAC RTX (All versions), SIMIT Simulation Platform (All versions). The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP- Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens recommends the following workarounds and mitigations users can apply to reduce risk:

- SIMATIC ET 200pro IM154-8 PN/DP CPU, SIMATIC ET 200pro IM154-8F PN/DP CPU, SIMATIC ET 200pro IM154-8FX PN/DP CPU, SIMATIC ET 200S IM151-8 PN/DP CPU, SIMATIC ET 200S IM151-8F PN/DP CPU: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 314C-2 PN/DP: Update to V3.3.19 or later version
- SIMATIC S7-300 CPU 315-2 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 315F-2 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 315T-3 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 317-2 PN/DP, SIMATIC S7-300 CPU 317F-2 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 317T-3 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 317TF-3 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 319-3 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-300 CPU 319F-3 PN/DP: Update to V3.2.19 or later version
- SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants): Update to v6.0.10 or later version.
- SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants): Update to V8.2.3 or later version.

- SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants): Update to V10.1.1 or later version.

- SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): Update to V2.0.0 or later version.

- SIMATIC TDC CP51M1: Update to V1.1.10 or later version
- SIMATIC TDC CPU555: Update to V1.2.1 or later version

- SIPLUS ET 200S IM151-8 PN/DP CPU: Update to V3.2.19 or later version
- SIPLUS ET 200S IM151-8F PN/DP CPU: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 314C-2 PN/DP: Update to V3.3.19 or later version
- SIPLUS S7-300 CPU 315-2 PN/DP: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 315F-2 PN/DP: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 317-2 PN/DP: Update to V3.2.19 or later version
- SIPLUS S7-300 CPU 317F-2 PN/DP: Update to V3.2.19 or later version

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

- Limit access to Port 102/TCP to trusted users and systems only.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for industrial security and to follow the recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens.

For additional information, please refer to Siemens Security Advisory SSA-446448 - PDF Version, SSA-446448 – TXT Version, or SSA-446448 – CSAF Version.

See Also

https://cert-portal.siemens.com/productcert/pdf/ssa-446448.pdf

https://www.cisa.gov/news-events/ics-advisories/icsa-22-104-06

Plugin Details

Severity: High

ID: 500641

Version: 1.10

Type: remote

Family: Tenable.ot

Published: 4/28/2022

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2022-25622

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:simatic_s7-400h_v6_firmware, cpe:/o:siemens:simatic_et_200mp_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_firmware, cpe:/o:siemens:simatic_et_200eco_firmware, cpe:/o:siemens:simatic_tdc_cp51m1_firmware, cpe:/o:siemens:simatic_s7-400_pn%2fdp_v7_firmware, cpe:/o:siemens:simatic_et_200sp_firmware, cpe:/o:siemens:simatic_et_200s_firmware, cpe:/o:siemens:simatic_s7-410_v10_firmware, cpe:/o:siemens:simatic_tdc_cpu555_firmware, cpe:/o:siemens:simatic_et_200pro_firmware, cpe:/o:siemens:simatic_s7-410_v8_firmware, cpe:/o:siemens:simatic_s7-300_cpu_firmware

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 4/12/2022

Vulnerability Publication Date: 4/12/2022

Reference Information

CVE: CVE-2022-25622

CWE: 400

ICSA: 22-104-06