Synopsis
The remote OT asset is affected by a vulnerability.
Description
A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01;Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02; SIPROTEC 7SJ686 :
All versions < V4.87; SIPROTEC 7UT686 : All versions < V 4.02; SIPROTEC 7SD686 : All versions < V 4.05; SIPROTEC 7SJ66 : All versions <V 4.30. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations. A legitimate user must be logged into the web interface for the attack to be successful.
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.
Siemens has released a new firmware version (V4.29.01) to address these vulnerabilities. It can be found at the SIPROTEC 4 downloads area at the following Siemens web site:
http://www.siemens.com/downloads/siprotec-4
Siemens recommends users protect network access with appropriate mechanisms such as firewalls, segmentation, and VPN.
Siemens also advises that users configure the operational environment according to Siemens’ Operational Guidelines for Industrial Security. Please see the specific product manual for more information. Manuals can be obtained from the downloads menu at the following Siemens web site:
http://www.siemens.com/gridsecurity
For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security Advisory SSA-452237 at the following location:
http://www.siemens.com/cert/advisories
Plugin Details
Supported Sensors: Tenable OT Security
Risk Information
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:siemens:siprotec_4_7ut686_firmware, cpe:/o:siemens:siprotec_4_7sj66_firmware, cpe:/o:siemens:siprotec_4_7sj686_firmware, cpe:/o:siemens:siprotec_4_7sd686_firmware
Required KB Items: Tenable.ot/Siemens
Exploit Ease: No known exploits are available
Patch Publication Date: 9/6/2016
Vulnerability Publication Date: 9/6/2016