Synopsis
The remote OT asset is affected by a vulnerability.
Description
Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
- Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
(CVE-2020-8745)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.
Siemens has released updates for several affected products and is currently working on BIOS updates that include chipset microcode updates for further products.
- SIMATIC Drive Controller family: Update BIOS to v05.00.01.00. The update can be obtained from a Siemens account manager
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update BIOS to v0209_0105 or later versions
- SIMATIC Field PG M5: Update BIOS to v22.01.08
- SIMATIC Field PG M6: Update BIOS to v26.01.08 or later version
- SIMATIC IPC127E: Update BIOS to v27.01.05
- SIMATIC IPC427E (incl. SIPLUS variants): Update BIOS to v21.01.15
- SIMATIC IPC477E: Update BIOS to v21.01.15
- SIMATIC IPC477E Pro: Update BIOS to v21.01.15
- SIMATIC IPC527G: Update BIOS to v1.4.0
- SIMATIC IPC547G: Update BIOS to R1.30.0
- SIMATIC IPC627E: Update BIOS to v25.02.08
- SIMATIC IPC647E: Update BIOS to v25.02.08
- SIMATIC IPC677E: Update BIOS to v25.02.08
- SIMATIC IPC847E: Update BIOS to v25.02.08
- SIMATIC ITP1000: Update BIOS to v23.01.08
- SINUMERIK 828D HW PU.4: Update BIOS to v08.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK MC MCU 1720: Update BIOS to v05.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK ONE NCU 1740: Update BIOS to v04.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK ONE PPU 1740: Update BIOS to v06.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:
- Siemens recommends limiting the possibilities to run untrusted code.
- Siemens recommends applying the defense-in-depth concept to reduce the probability for untrusted code to run on the system.
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.
Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.
For more information see Siemens Security Advisory SSA-678983
Plugin Details
Supported Sensors: Tenable OT Security
Risk Information
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:siemens:simatic_et200sp_1515sp_pc2_firmware
Required KB Items: Tenable.ot/Siemens
Exploit Ease: No known exploits are available
Patch Publication Date: 11/12/2020
Vulnerability Publication Date: 11/12/2020