Sign-up

ID

VAR-201711-0761


CVE

CVE-2017-12739


TITLE

SICAM RTU SM-2556 COM Module arbitrary code execution vulnerability

Trust: 0.8

sources: IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb // CNVD: CNVD-2017-33871

DESCRIPTION

An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow unauthenticated remote attackers to execute arbitrary code on the affected device. Siemens SICAM RTUs SM-2556 COM Module firmware contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The SM-2556 communication module is a protocol component for LAN/WAN communication with a Fast Ethernet interface that can be connected to the SICAM1703 and SICAMRTU substation controllers. Multiple Siemens SICAM RTU Products are prone to multiple security vulnerabilities. This can allow the attacker to steal cookie-based authentication credentials and aid in further attacks. Siemens SICAM RTUs is a substation controller of Siemens (Siemens) in Germany. SM-2556 COM Modules is used in one of the communication modules for LAN/WAN. Products using the following firmware are affected: ENOS00; ERAC00; ETA2; ETLS00; MODi00; DNPi00. SEC Consult Vulnerability Lab Security Advisory < 20171114-0 > ======================================================================= title: Authentication bypass, cross-site scripting & code execution product: Siemens SICAM RTUs SM-2556 COM Modules (firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and DNPi00 vulnerable version: FW 1549 Revision 07 fixed version: none, see Workaround section below CVE number: CVE-2017-12737 (authentication bypass) CVE-2017-12738 (XSS) CVE-2017-12739 (web server) impact: critical homepage: www.siemens.com found: 2017-08-17 by: SEC Consult Vulnerability Lab An integrated part of SEC Consult Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Siemens is a global powerhouse focusing on the areas of electrification, automation and digitalization. One of the world's largest producers of energy-efficient, resource-saving technologies, Siemens is a leading supplier of systems for power generation and transmission as well as medical diagnosis." Source: https://www.siemens.com/global/en/home/company/about.html Business recommendation: ------------------------ SEC Consult recommends not to use this device in production until a thorough security review has been performed by security professionals and all identified issues have been resolved. The device must not be accessible from untrusted networks. Vulnerability overview/description: ----------------------------------- 1) Authentication Bypass (client-side "authentication" enforcement) The web interface (TCP port 80) suffers from an authentication bypass vulnerability that allows unauthenticated attackers to access arbitray functionality and information (i.e. password lists) available through the webserver. 2) Reflected Cross-Site Scripting The web interface provides a "ping" functionality. This form is vulnerable to reflected cross-site-scripting because of missing input handling and output encoding. 3) Outdated Webserver (GoAhead) The used webserver version contains known weaknesses. Proof of concept: ----------------- 1) Authentication Bypass Use a browser which has JavaScript disabled ("Authentication" checks are performed client-side) and open legitimate URLs directly. Examples: http://<hostname>/start.asp http://<hostname>/pwliste.asp http://<hostname>/goform/webforms_readmem?start_addr=0&length=100 2) Reflected Cross-Site Scripting All parameters in "webforms_ping" are vulnerable to reflected XSS: http://<hostname>/goform/webforms_ping?ip_address=1.1.1.com%3Cscript%3Ealert(%27XSS%20proof-of-concept%27)%3C/script%3E1&length_data=32&count_pings=4&timeout=1 3) Outdated Webserver The used version of "GoAhead" webserver is 2.1.7 (released in Oct. 2003) This version has known vulnerabilities: http://aluigi.altervista.org/adv/goahead-adv3.txt https://web.archive.org/web/20080314153252/http:/data.goahead.com:80/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-asp Vulnerable / tested versions: ----------------------------- SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00 and DNPi00 (FW 1549 Revision 07) Vendor contact timeline: ------------------------ 2017-09-25: Encrypted advisory sent to Siemens ProductCERT 2017-10-02: Requesting status update. 2017-10-09: Vendor states that the "affected device is out of service" and provides workaround (disable webserver). They are "still assessing the next steps". 2017-11-02: Requesting status update. 2017-11-06: Siemens ProductCERT will reach out to development team and keep us posted. 2017-11-08: Siemens ProductCERT prepares advisory. 2017-11-08: Asking about planned release date. 2017-11-13: Siemens ProductCERT provides planned release date (2017-11-14) 2017-11-14: Coordinated public release. Solution: --------- No firmware update is available as the device is no longer supported by the vendor. Workaround: ----------- According to the vendor the webserver can be disabled to mitigate all the vulnerabilities documented in this advisory. The webserver is optional and only used for commissioning and debugging purposes. The vendor published the following document for further information: https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf Advisory URL: ------------- https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/career/index.html Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/contact/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Twitter: https://twitter.com/sec_consult EOF SEC Consult Vulnerability Lab / @2017

Trust: 2.88

sources: NVD: CVE-2017-12739 // JVNDB: JVNDB-2017-010180 // CNVD: CNVD-2017-33871 // BID: 101884 // IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb // VULHUB: VHN-103291 // VULMON: CVE-2017-12739 // PACKETSTORM: 144982

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb // CNVD: CNVD-2017-33871

AFFECTED PRODUCTS

vendor:siemensmodel:sm-2556scope:eqversion:dnpi00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:enos00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:erac00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:eta2

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:etls00

Trust: 2.4

vendor:siemensmodel:sm-2556scope:eqversion:modi00

Trust: 2.4

vendor:siemensmodel:sicam rtus sm-2556 com modulesscope: - version: -

Trust: 0.6

vendor:siemensmodel:sicam rtus sm-2556 com modules modi00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules etls00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules eta2scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules erac00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules enos00scope: - version: -

Trust: 0.3

vendor:siemensmodel:sicam rtus sm-2556 com modules dnpi00scope: - version: -

Trust: 0.3

vendor:sm 2556model:dnpi00scope: - version: -

Trust: 0.2

vendor:sm 2556model:enos00scope: - version: -

Trust: 0.2

vendor:sm 2556model:erac00scope: - version: -

Trust: 0.2

vendor:sm 2556model:eta2scope: - version: -

Trust: 0.2

vendor:sm 2556model:etls00scope: - version: -

Trust: 0.2

vendor:sm 2556model:modi00scope: - version: -

Trust: 0.2

sources: IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb // CNVD: CNVD-2017-33871 // BID: 101884 // JVNDB: JVNDB-2017-010180 // CNNVD: CNNVD-201711-556 // NVD: CVE-2017-12739

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-12739
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-12739
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2017-33871
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201711-556
value: CRITICAL

Trust: 0.6

IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb
value: CRITICAL

Trust: 0.2

VULHUB: VHN-103291
value: HIGH

Trust: 0.1

VULMON: CVE-2017-12739
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-12739
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2017-33871
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-103291
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-12739
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb // CNVD: CNVD-2017-33871 // VULHUB: VHN-103291 // VULMON: CVE-2017-12739 // JVNDB: JVNDB-2017-010180 // CNNVD: CNNVD-201711-556 // NVD: CVE-2017-12739

PROBLEMTYPE DATA

problemtype:CWE-1188

Trust: 1.0

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-103291 // JVNDB: JVNDB-2017-010180 // NVD: CVE-2017-12739

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201711-556

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201711-556

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-010180

PATCH
title:SSA-164516url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf
Trust: 0.8
title:SICAMRTUSM-2556COM module patch for arbitrary code execution vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/106362
Trust: 0.6
title:Siemens SICAM RTUs SM-2556 COM Modules Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76395
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-33871 // 
            
            
            
            JVNDB: JVNDB-2017-010180 // 
            
            
            
            CNNVD: CNNVD-201711-556

EXTERNAL IDS
db:NVDid:CVE-2017-12739
Trust: 3.8
db:SIEMENSid:SSA-164516
Trust: 2.8
db:BIDid:101884
Trust: 2.1
db:ICS CERTid:ICSA-17-320-02
Trust: 1.7
db:CNNVDid:CNNVD-201711-556
Trust: 0.9
db:CNVDid:CNVD-2017-33871
Trust: 0.8
db:JVNDBid:JVNDB-2017-010180
Trust: 0.8
db:IVDid:5F24B44B-F141-44FE-87CD-A4FB6ED78BEB
Trust: 0.2
db:PACKETSTORMid:144982
Trust: 0.2
db:VULHUBid:VHN-103291
Trust: 0.1
db:VULMONid:CVE-2017-12739
Trust: 0.1
sources:
            
            
            IVD: 5f24b44b-f141-44fe-87cd-a4fb6ed78beb // 
            
            
            
            CNVD: CNVD-2017-33871 // 
            
            
            
            VULHUB: VHN-103291 // 
            
            
            
            VULMON: CVE-2017-12739 // 
            
            
            
            BID: 101884 // 
            
            
            
            JVNDB: JVNDB-2017-010180 // 
            
            
            
            PACKETSTORM: 144982 // 
            
            
            
            CNNVD: CNNVD-201711-556 // 
            
            
            
            NVD: CVE-2017-12739

REFERENCES
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-164516.pdf
Trust: 2.8
url:http://www.securityfocus.com/bid/101884
Trust: 1.9
url:https://ics-cert.us-cert.gov/advisories/icsa-17-320-02
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-12739
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12739
Trust: 0.8
url:http://www.siemens.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/1188.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://packetstormsecurity.com/files/144982/siemens-sicam-rtus-sm-2556-com-modules-xss-bypass-code-execution.html
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12738
Trust: 0.1
url:https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
Trust: 0.1
url:http://<hostname>/goform/webforms_ping?ip_address=1.1.1.com%3cscript%3ealert(%27xss%20proof-of-concept%27)%3c/script%3e1&length_data=32&count_pings=4&timeout=1
Trust: 0.1
url:https://www.sec-consult.com/en/career/index.html
Trust: 0.1
url:http://<hostname>/goform/webforms_readmem?start_addr=0&length=100
Trust: 0.1
url:https://www.sec-consult.com
Trust: 0.1
url:https://web.archive.org/web/20080314153252/http:/data.goahead.com:80/software/webserver/2.1.8/release.htm#bug-with-urls-like-asp
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-12737
Trust: 0.1
url:https://www.sec-consult.com/en/contact/index.html
Trust: 0.1
url:https://twitter.com/sec_consult
Trust: 0.1
url:https://www.siemens.com/global/en/home/company/about.html
Trust: 0.1
url:http://aluigi.altervista.org/adv/goahead-adv3.txt
Trust: 0.1
url:http://<hostname>/pwliste.asp
Trust: 0.1
url:http://<hostname>/start.asp
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-33871 // 
            
            
            
            VULHUB: VHN-103291 // 
            
            
            
            VULMON: CVE-2017-12739 // 
            
            
            
            BID: 101884 // 
            
            
            
            JVNDB: JVNDB-2017-010180 // 
            
            
            
            PACKETSTORM: 144982 // 
            
            
            
            CNNVD: CNNVD-201711-556 // 
            
            
            
            NVD: CVE-2017-12739

CREDITS
SEC Consult Vulnerability Lab.
Trust: 0.3
sources:
            
            
            BID: 101884

SOURCES
db:IVDid:5f24b44b-f141-44fe-87cd-a4fb6ed78beb
db:CNVDid:CNVD-2017-33871
db:VULHUBid:VHN-103291
db:VULMONid:CVE-2017-12739
db:BIDid:101884
db:JVNDBid:JVNDB-2017-010180
db:PACKETSTORMid:144982
db:CNNVDid:CNNVD-201711-556
db:NVDid:CVE-2017-12739

LAST UPDATE DATE
2025-04-20T23:25:54.450000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-33871date:2017-11-17T00:00:00
db:VULHUBid:VHN-103291date:2019-10-03T00:00:00
db:VULMONid:CVE-2017-12739date:2019-10-03T00:00:00
db:BIDid:101884date:2017-12-19T22:37:00
db:JVNDBid:JVNDB-2017-010180date:2017-12-06T00:00:00
db:CNNVDid:CNNVD-201711-556date:2019-10-23T00:00:00
db:NVDid:CVE-2017-12739date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:5f24b44b-f141-44fe-87cd-a4fb6ed78bebdate:2017-11-15T00:00:00
db:CNVDid:CNVD-2017-33871date:2017-11-15T00:00:00
db:VULHUBid:VHN-103291date:2017-11-15T00:00:00
db:VULMONid:CVE-2017-12739date:2017-11-15T00:00:00
db:BIDid:101884date:2017-11-14T00:00:00
db:JVNDBid:JVNDB-2017-010180date:2017-12-06T00:00:00
db:PACKETSTORMid:144982date:2017-11-14T15:17:47
db:CNNVDid:CNNVD-201711-556date:2017-11-16T00:00:00
db:NVDid:CVE-2017-12739date:2017-11-15T08:29:00.297