Sign-up

ID

VAR-201608-0418


TITLE

Siemens 300/400 series PLC Remote control vulnerability

Trust: 1.0

sources: IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1 // CNVD: CNVD-2017-26804

DESCRIPTION

The programmable controller (PLC) is developed on the basis of relay control and computer control, and gradually developed into a new microprocessor-based, integrated computer technology, automatic control technology and communication technology. Industrial automatic control device. Medium-sized PLC S7-300 and large-scale PLC The S7-400 is a Siemens product that can be used to form MPI, PROFIBUS and Industrial Ethernet. There is a remote control vulnerability in the Siemens 300/400 series PLC. The attacker can use the Siemens PLC to perform TCP communication through port 102. This script can remotely control the start and stop of the PLC by sending a specific message to port 102 of the PLC. The SiemensS7300/400PLC is a modular universal controller for the manufacturing industry from Siemens. The SiemensS7300/400PLC has permission to bypass the shutdown vulnerability. If the recovery requires manual restart of the PLC, no permission problems are encountered during the process

Trust: 1.62

sources: CNVD: CNVD-2017-26804 // CNVD: CNVD-2016-05901 // IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1 // IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.2

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1 // IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf // CNVD: CNVD-2017-26804 // CNVD: CNVD-2016-05901

AFFECTED PRODUCTS

vendor:siemensmodel:s7-300/400 plcscope: - version: -

Trust: 1.2

vendor:siemensmodel:s7-300/400 plcscope:eqversion:*

Trust: 0.6

sources: IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1 // IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf // CNVD: CNVD-2017-26804 // CNVD: CNVD-2016-05901

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2017-26804
value: HIGH

Trust: 0.6

CNVD: CNVD-2016-05901
value: HIGH

Trust: 0.6

IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d
value: HIGH

Trust: 0.2

IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1
value: HIGH

Trust: 0.2

IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf
value: HIGH

Trust: 0.2

CNVD: CNVD-2017-26804
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2016-05901
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1 // IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf // CNVD: CNVD-2017-26804 // CNVD: CNVD-2016-05901

TYPE

Control error

Trust: 0.4

sources: IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1

PATCH

title:Remote Control Vulnerability in Siemens 300/400 Series PLCurl:https://www.cnvd.org.cn/patchinfo/show/116371

Trust: 0.6

sources: CNVD: CNVD-2017-26804

EXTERNAL IDS

db:ICS CERT ALERTid:ICS-ALERT-11-186-01

Trust: 1.2

db:CNVDid:CNVD-2017-26804

Trust: 1.0

db:CNVDid:CNVD-2016-05901

Trust: 0.8

db:IVDid:D736E467-E11A-43B6-AC1D-B6DD8EE7C78D

Trust: 0.2

db:IVDid:E2E48A0F-39AB-11E9-B679-000C29342CB1

Trust: 0.2

db:IVDid:D7364D14-B977-40E3-A6B0-E5FC7A82EBBF

Trust: 0.2

sources: IVD: d736e467-e11a-43b6-ac1d-b6dd8ee7c78d // IVD: e2e48a0f-39ab-11e9-b679-000c29342cb1 // IVD: d7364d14-b977-40e3-a6b0-e5fc7a82ebbf // CNVD: CNVD-2017-26804 // CNVD: CNVD-2016-05901

REFERENCES

url:https://ics-cert.us-cert.gov/alerts/ics-alert-11-186-01

Trust: 1.2

url:https://support.industry.siemens.com/cs/document/51401544/potential-password-security-weakness-in-simatic-controllers?dti=0&lc=en-ww

Trust: 0.6

sources: CNVD: CNVD-2017-26804 // CNVD: CNVD-2016-05901

SOURCES

db:IVDid:d736e467-e11a-43b6-ac1d-b6dd8ee7c78d
db:IVDid:e2e48a0f-39ab-11e9-b679-000c29342cb1
db:IVDid:d7364d14-b977-40e3-a6b0-e5fc7a82ebbf
db:CNVDid:CNVD-2017-26804
db:CNVDid:CNVD-2016-05901

LAST UPDATE DATE

2022-05-17T02:10:35.273000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2017-26804date:2018-03-07T00:00:00
db:CNVDid:CNVD-2016-05901date:2016-08-26T00:00:00

SOURCES RELEASE DATE

db:IVDid:d736e467-e11a-43b6-ac1d-b6dd8ee7c78ddate:2017-09-15T00:00:00
db:IVDid:e2e48a0f-39ab-11e9-b679-000c29342cb1date:2017-09-15T00:00:00
db:IVDid:d7364d14-b977-40e3-a6b0-e5fc7a82ebbfdate:2016-08-03T00:00:00
db:CNVDid:CNVD-2017-26804date:2018-03-08T00:00:00
db:CNVDid:CNVD-2016-05901date:2016-06-13T00:00:00