Detections
Analytics

Siemens Industrial PCs and CNC devices Improper Privilege Management (CVE-2020-8745)

medium Tenable OT Security Plugin ID 500702

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.

 - Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
 (CVE-2020-8745)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens has released updates for several affected products and is currently working on BIOS updates that include chipset microcode updates for further products.

- SIMATIC Drive Controller family: Update BIOS to v05.00.01.00. The update can be obtained from a Siemens account manager
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2: Update BIOS to v0209_0105 or later versions
- SIMATIC Field PG M5: Update BIOS to v22.01.08

- SIMATIC Field PG M6: Update BIOS to v26.01.08 or later version

- SIMATIC IPC127E: Update BIOS to v27.01.05
- SIMATIC IPC427E (incl. SIPLUS variants): Update BIOS to v21.01.15
- SIMATIC IPC477E: Update BIOS to v21.01.15
- SIMATIC IPC477E Pro: Update BIOS to v21.01.15
- SIMATIC IPC527G: Update BIOS to v1.4.0
- SIMATIC IPC547G: Update BIOS to R1.30.0
- SIMATIC IPC627E: Update BIOS to v25.02.08
- SIMATIC IPC647E: Update BIOS to v25.02.08
- SIMATIC IPC677E: Update BIOS to v25.02.08
- SIMATIC IPC847E: Update BIOS to v25.02.08
- SIMATIC ITP1000: Update BIOS to v23.01.08
- SINUMERIK 828D HW PU.4: Update BIOS to v08.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK MC MCU 1720: Update BIOS to v05.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK ONE NCU 1740: Update BIOS to v04.00.00.00. SINUMERIK software can be obtained from a Siemens account manager
- SINUMERIK ONE PPU 1740: Update BIOS to v06.00.00.00. SINUMERIK software can be obtained from a Siemens account manager

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

- Siemens recommends limiting the possibilities to run untrusted code.
- Siemens recommends applying the defense-in-depth concept to reduce the probability for untrusted code to run on the system.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see Siemens Security Advisory SSA-678983

See Also

http://www.nessus.org/u?e0627cbb

https://security.netapp.com/advisory/ntap-20201113-0005/

https://www.cisa.gov/news-events/ics-advisories/icsa-22-132-05

https://security.netapp.com/advisory/ntap-20201113-0002/

https://cert-portal.siemens.com/productcert/pdf/ssa-678983.pdf

Plugin Details

Severity: Medium

ID: 500702

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 10/14/2022

Updated: 10/9/2023

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-8745

CVSS v3

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:simatic_et200sp_1515sp_pc2_firmware

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 11/12/2020

Vulnerability Publication Date: 11/12/2020

Reference Information

CVE: CVE-2020-8745