Sign-up

ID

VAR-201711-0759


CVE

CVE-2017-12737


TITLE

SICAM RTU SM-2556 COM Module Information Disclosure Vulnerability

Trust: 0.8

sources: IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965 // CNVD: CNVD-2017-33869

DESCRIPTION

An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow unauthenticated remote attackers to obtain sensitive device information over the network. The SM-2556 communication module is a protocol component for LAN/WAN communication with a Fast Ethernet interface that can be connected to the SICAM1703 and SICAMRTU substation controllers. Multiple Siemens SICAM RTU Products are prone to multiple security vulnerabilities. Attackers can exploit these issues to obtain sensitive information, to execute arbitrary code or arbitrary HTML or script code in the browser of an unsuspecting user within the context of the affected application. This can allow the attacker to steal cookie-based authentication credentials and aid in further attacks. Siemens SICAM RTUs is a substation controller of Siemens (Siemens) in Germany. SM-2556 COM Modules is used in one of the communication modules for LAN/WAN. Products using the following firmware are affected: ENOS00; ERAC00; ETA2; ETLS00; MODi00; DNPi00. SEC Consult Vulnerability Lab Security Advisory < 20171114-0 > ======================================================================= title: Authentication bypass, cross-site scripting & code execution product: Siemens SICAM RTUs SM-2556 COM Modules (firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and DNPi00 vulnerable version: FW 1549 Revision 07 fixed version: none, see Workaround section below CVE number: CVE-2017-12737 (authentication bypass) CVE-2017-12738 (XSS) CVE-2017-12739 (web server) impact: critical homepage: www.siemens.com found: 2017-08-17 by: SEC Consult Vulnerability Lab An integrated part of SEC Consult Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Siemens is a global powerhouse focusing on the areas of electrification, automation and digitalization. One of the world's largest producers of energy-efficient, resource-saving technologies, Siemens is a leading supplier of systems for power generation and transmission as well as medical diagnosis." Source: https://www.siemens.com/global/en/home/company/about.html Business recommendation: ------------------------ SEC Consult recommends not to use this device in production until a thorough security review has been performed by security professionals and all identified issues have been resolved. The device must not be accessible from untrusted networks. Vulnerability overview/description: ----------------------------------- 1) Authentication Bypass (client-side "authentication" enforcement) The web interface (TCP port 80) suffers from an authentication bypass vulnerability that allows unauthenticated attackers to access arbitray functionality and information (i.e. password lists) available through the webserver. 2) Reflected Cross-Site Scripting The web interface provides a "ping" functionality. This form is vulnerable to reflected cross-site-scripting because of missing input handling and output encoding. 3) Outdated Webserver (GoAhead) The used webserver version contains known weaknesses. Proof of concept: ----------------- 1) Authentication Bypass Use a browser which has JavaScript disabled ("Authentication" checks are performed client-side) and open legitimate URLs directly. Examples: http://<hostname>/start.asp http://<hostname>/pwliste.asp http://<hostname>/goform/webforms_readmem?start_addr=0&length=100 2) Reflected Cross-Site Scripting All parameters in "webforms_ping" are vulnerable to reflected XSS: http://<hostname>/goform/webforms_ping?ip_address=1.1.1.com%3Cscript%3Ealert(%27XSS%20proof-of-concept%27)%3C/script%3E1&length_data=32&count_pings=4&timeout=1 3) Outdated Webserver The used version of "GoAhead" webserver is 2.1.7 (released in Oct. 2003) This version has known vulnerabilities: http://aluigi.altervista.org/adv/goahead-adv3.txt https://web.archive.org/web/20080314153252/http:/data.goahead.com:80/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-asp Vulnerable / tested versions: ----------------------------- SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and DNPi00 (FW 1549 Revision 07) Vendor contact timeline: ------------------------ 2017-09-25: Encrypted advisory sent to Siemens ProductCERT 2017-10-02: Requesting status update. 2017-10-09: Vendor states that the "affected device is out of service" and provides workaround (disable webserver). They are "still assessing the next steps". 2017-11-02: Requesting status update. 2017-11-06: Siemens ProductCERT will reach out to development team and keep us posted. 2017-11-08: Siemens ProductCERT prepares advisory. 2017-11-08: Asking about planned release date. 2017-11-13: Siemens ProductCERT provides planned release date (2017-11-14) 2017-11-14: Coordinated public release. Solution: --------- No firmware update is available as the device is no longer supported by the vendor. Workaround: ----------- According to the vendor the webserver can be disabled to mitigate all the vulnerabilities documented in this advisory. The webserver is optional and only used for commissioning and debugging purposes. The vendor published the following document for further information: https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf Advisory URL: ------------- https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/career/index.html Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/contact/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Twitter: https://twitter.com/sec_consult EOF SEC Consult Vulnerability Lab / @2017

Trust: 2.79

sources: NVD: CVE-2017-12737 // JVNDB: JVNDB-2017-010178 // CNVD: CNVD-2017-33869 // BID: 101884 // IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965 // VULHUB: VHN-103289 // PACKETSTORM: 144982

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965 // CNVD: CNVD-2017-33869

AFFECTED PRODUCTS

vendor:siemensmodel:sm-2556scope:eqversion:dnpi00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:enos00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:erac00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:eta2

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:etls00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:modi00

Trust: 2.4

vendor:siemensmodel:sicam rtus sm-2556 com modulesscope: - version: -

Trust: 0.6

vendor:siemensmodel:sicam rtus sm-2556 com modules modi00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules etls00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules eta2scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules erac00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules enos00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules dnpi00scope: - version: -

Trust: 0.3

vendor:sm 2556model:dnpi00scope: - version: -

Trust: 0.2

vendor:sm 2556model:enos00scope: - version: -

Trust: 0.2

vendor:sm 2556model:erac00scope: - version: -

Trust: 0.2

vendor:sm 2556model:eta2scope: - version: -

Trust: 0.2

vendor:sm 2556model:etls00scope: - version: -

Trust: 0.2

vendor:sm 2556model:modi00scope: - version: -

Trust: 0.2

sources: IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965 // CNVD: CNVD-2017-33869 // BID: 101884 // JVNDB: JVNDB-2017-010178 // CNNVD: CNNVD-201711-558 // NVD: CVE-2017-12737

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-12737
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-12737
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-33869
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201711-558
value: MEDIUM

Trust: 0.6

IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965
value: MEDIUM

Trust: 0.2

VULHUB: VHN-103289
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-12737
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-33869
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-103289
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-12737
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965 // CNVD: CNVD-2017-33869 // VULHUB: VHN-103289 // JVNDB: JVNDB-2017-010178 // CNNVD: CNNVD-201711-558 // NVD: CVE-2017-12737

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-103289 // JVNDB: JVNDB-2017-010178 // NVD: CVE-2017-12737

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201711-558

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201711-558

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-010178

PATCH
title:SSA-164516url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf
Trust: 0.8
title:SICAMRTUSM-2556COM module information disclosure vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/106364
Trust: 0.6
title:Siemens SICAM RTUs SM-2556 COM Modules Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76397
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-33869 // 
            
            
            
            JVNDB: JVNDB-2017-010178 // 
            
            
            
            CNNVD: CNNVD-201711-558

EXTERNAL IDS
db:NVDid:CVE-2017-12737
Trust: 3.7
db:SIEMENSid:SSA-164516
Trust: 2.7
db:ICS CERTid:ICSA-17-320-02
Trust: 1.7
db:BIDid:101884
Trust: 1.4
db:CNNVDid:CNNVD-201711-558
Trust: 0.9
db:CNVDid:CNVD-2017-33869
Trust: 0.8
db:JVNDBid:JVNDB-2017-010178
Trust: 0.8
db:IVDid:0A156D51-9C78-4879-AE59-6F5C635E9965
Trust: 0.2
db:PACKETSTORMid:144982
Trust: 0.2
db:VULHUBid:VHN-103289
Trust: 0.1
sources:
            
            
            IVD: 0a156d51-9c78-4879-ae59-6f5c635e9965 // 
            
            
            
            CNVD: CNVD-2017-33869 // 
            
            
            
            VULHUB: VHN-103289 // 
            
            
            
            BID: 101884 // 
            
            
            
            JVNDB: JVNDB-2017-010178 // 
            
            
            
            PACKETSTORM: 144982 // 
            
            
            
            CNNVD: CNNVD-201711-558 // 
            
            
            
            NVD: CVE-2017-12737

REFERENCES
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf
Trust: 2.7
url:https://ics-cert.us-cert.gov/advisories/icsa-17-320-02
Trust: 1.7
url:http://www.securityfocus.com/bid/101884
Trust: 1.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12737
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12737
Trust: 0.8
url:http://www.siemens.com/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2017-12738
Trust: 0.1
url:https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
Trust: 0.1
url:http://<hostname>/goform/webforms_ping?ip_address=1.1.1.com%3cscript%3ealert(%27xss%20proof-of-concept%27)%3c/script%3e1&length_data=32&count_pings=4&timeout=1
Trust: 0.1
url:https://www.sec-consult.com/en/career/index.html
Trust: 0.1
url:http://<hostname>/goform/webforms_readmem?start_addr=0&length=100
Trust: 0.1
url:https://www.sec-consult.com
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12739
Trust: 0.1
url:https://web.archive.org/web/20080314153252/http:/data.goahead.com:80/software/webserver/2.1.8/release.htm#bug-with-urls-like-asp
Trust: 0.1
url:https://www.sec-consult.com/en/contact/index.html
Trust: 0.1
url:https://twitter.com/sec_consult
Trust: 0.1
url:https://www.siemens.com/global/en/home/company/about.html
Trust: 0.1
url:http://aluigi.altervista.org/adv/goahead-adv3.txt
Trust: 0.1
url:http://<hostname>/pwliste.asp
Trust: 0.1
url:http://<hostname>/start.asp
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-33869 // 
            
            
            
            VULHUB: VHN-103289 // 
            
            
            
            BID: 101884 // 
            
            
            
            JVNDB: JVNDB-2017-010178 // 
            
            
            
            PACKETSTORM: 144982 // 
            
            
            
            CNNVD: CNNVD-201711-558 // 
            
            
            
            NVD: CVE-2017-12737

CREDITS
SEC Consult Vulnerability Lab.
Trust: 0.3
sources:
            
            
            BID: 101884

SOURCES
db:IVDid:0a156d51-9c78-4879-ae59-6f5c635e9965
db:CNVDid:CNVD-2017-33869
db:VULHUBid:VHN-103289
db:BIDid:101884
db:JVNDBid:JVNDB-2017-010178
db:PACKETSTORMid:144982
db:CNNVDid:CNNVD-201711-558
db:NVDid:CVE-2017-12737

LAST UPDATE DATE
2025-04-20T23:25:54.496000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-33869date:2017-11-17T00:00:00
db:VULHUBid:VHN-103289date:2017-11-30T00:00:00
db:BIDid:101884date:2017-12-19T22:37:00
db:JVNDBid:JVNDB-2017-010178date:2017-12-06T00:00:00
db:CNNVDid:CNNVD-201711-558date:2017-11-16T00:00:00
db:NVDid:CVE-2017-12737date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:0a156d51-9c78-4879-ae59-6f5c635e9965date:2017-11-15T00:00:00
db:CNVDid:CNVD-2017-33869date:2017-11-15T00:00:00
db:VULHUBid:VHN-103289date:2017-11-15T00:00:00
db:BIDid:101884date:2017-11-14T00:00:00
db:JVNDBid:JVNDB-2017-010178date:2017-12-06T00:00:00
db:PACKETSTORMid:144982date:2017-11-14T15:17:47
db:CNNVDid:CNNVD-201711-558date:2017-11-16T00:00:00
db:NVDid:CVE-2017-12737date:2017-11-15T08:29:00.220