Siemens SINUMERIK ONE and SINUMERIK MC Insufficiently Protected Credentials (CVE-2022-38465)

high Tenable OT Security Plugin ID 500704

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family.
Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

- Expose the communication between the S7-1500 CPU and the HMI of the affected products only to trusted network environments.
- Protect access to the TIA Portal project and SINUMERIK NCU (including related memory cards) from unauthorized actors.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following the recommendations in the product manuals.

For more information, see Siemens security advisory SSA-568428 in HTML or CSAF.

Plugin Details

Severity: High

ID: 500704

Version: 1.7

Type: remote

Family: Tenable.ot

Published: 11/7/2022

Updated: 3/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2022-38465

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:simatic_s7-1500_cpu_151511c-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_151511f-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1515f-2_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1515r-2_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1515t-2_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1516-3_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1516f-3_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1516pro_f_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1516t-3_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1516tf-3_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1517-3_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1517f-3_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_15prof-2_firmware, cpe:/o:siemens:simatic_drive_controller_cpu_1504d_tf_firmware, cpe:/o:siemens:simatic_drive_controller_cpu_1507d_tf_firmware, cpe:/o:siemens:simatic_et_200_sp_open_controller_cpu_1515sp_pc2_firmware, cpe:/o:siemens:simatic_et_200_sp_open_controller_cpu_1515sp_pc_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1211c_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1212c_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1212fc_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1214c_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1214fc_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1215c_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1215fc_firmware, cpe:/o:siemens:simatic_s7-1200_cpu_12_1217c_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1510sp-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1510sp_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1511-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1511t-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1511tf-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1512c-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1512sp-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1512spf-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1513-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1513f-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1513r-1_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1515-2_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1518-4_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1518f-4_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1518hf-4_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1518t-4_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_1518tf-4_firmware, cpe:/o:siemens:simatic_s7-1500_cpu_15pro-2_firmware

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 10/11/2022

Vulnerability Publication Date: 10/11/2022

Reference Information

CVE: CVE-2022-38465

CWE: 522

Detections

Analytics