Siemens SIMATIC CP 343-1, CP 443-1 Authentication Bypass Vulnerability

critical Nessus Network Monitor Plugin ID 137

Synopsis

A vulnerable Siemens SIMATIC CP 443-1, CP 443-1 Advanced, CP 343-1 Advanced, or CP 343-1 Lean device has been detected.

Description

Siemens SIMATIC CP 443-1 and CP 443-1 Advanced Communication Processors with firmware versions lower than 3.2.9, CP 343-1 Advanced with firmware less than 3.0.44, and CP 343-1 Lean with firmware less than 3.1.1, have a flaw that allows an unauthenticated remote user with access to port 102/TCP to perform administrative actions, if the CPs configuration is stored on its corresponding CPU.

Solution

Update the CP 443-1 firmware to V3.2.9 or later. Update the CP 343-1 Advanced firmware to V3.0.44 or later. Update the CP 343-1 Lean firmware to V3.1.1 or later.

Plugin Details

Severity: Critical

ID: 137

Family: SCADA

Published: 5/21/2019

Updated: 9/30/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 9.7

Temporal Score: 7.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:C

Vulnerability Information

Patch Publication Date: 11/27/2015

Vulnerability Publication Date: 11/27/2015

Reference Information

CVE: CVE-2015-8214

BID: 78345

Detections

Analytics