Detections
Analytics
Siemens SIMATIC CP Out-of-Bounds Read (CVE-2020-9272)
high Tenable OT Security Plugin ID 501105
Synopsis
The remote OT asset is affected by a vulnerability.Description
ProFTPD 1.3.7 has an out-of-bounds (OOB) read vulnerability in mod_cap via the cap_text.c cap_to_text function.This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.Siemens recommends users update to the latest software version:
- SIMATIC NET CP 1543-1 (Incl. SIPLUS NET variants): Update to v3.0 or later
- SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0): Update to v1.1 or later
Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
- Disable the embedded FTP server. The server is deactivated in the default configuration.
- Limit access to Port 21/TCP to trusted IP addresses.
As a general security measure, Siemens strongly recommends users protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends users configure the environment according to Siemens operational guidelines for industrial security, and follow the recommendations in the product manual.
Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.
For more information about this issue, please see Siemens Security Advisory SSA-679335
See Also
https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES
https://github.com/proftpd/proftpd/issues/902
http://www.nessus.org/u?b5bae8e8
https://security.gentoo.org/glsa/202003-35
https://www.cisa.gov/news-events/ics-advisories/icsa-21-222-07
https://cert-portal.siemens.com/productcert/pdf/ssa-679335.pdf
Plugin Details
Severity: High
ID: 501105
Version: 1.2
Type: remote
Family: Tenable.ot
Published: 5/2/2023
Updated: 7/24/2023
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2020-9272
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:siemens:simatic_net_cp_1543-1_firmware, cpe:/o:siemens:simatic_net_cp_1545-1_firmware
Required KB Items: Tenable.ot/Siemens
Exploit Ease: No known exploits are available
Patch Publication Date: 2/20/2020
Vulnerability Publication Date: 2/20/2020
Reference Information
CVE: CVE-2020-9272