cnvd - cnvd-2021-37944

cnvd-2021-37944

Vulnerability from cnvd

Title: Siemens SIMATIC S7-1200和S7-1500 CPU系列内存保护绕过漏洞

Description:

Siemens SIMATIC S7-1200和S7-1500 CPU系列产品设计用于工业环境中的离散和连续控制，如全球制造业、食品和饮料以及化学工业。

Siemens SIMATIC S7-1200和S7-1500 CPU系列存在安全漏洞。未经验证的远程攻击者可利用漏洞将任意数据和代码写入受保护的内存区域，或读取敏感数据以发起进一步的攻击。

Severity: 高

Patch Name: Siemens SIMATIC S7-1200和S7-1500 CPU系列内存保护绕过漏洞的补丁

Patch Description:

Siemens SIMATIC S7-1200和S7-1500 CPU系列产品设计用于工业环境中的离散和连续控制，如全球制造业、食品和饮料以及化学工业。

Siemens SIMATIC S7-1200和S7-1500 CPU系列存在安全漏洞。未经验证的远程攻击者可利用漏洞将任意数据和代码写入受保护的内存区域，或读取敏感数据以发起进一步的攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf

Reference: https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf

Impacted products

Name
['Siemens SIMATIC Drive Controller family < V2.9.2', 'Siemens SIMATIC S7-1500 Software Controller', 'Siemens SIMATIC S7-PLCSIM Advanced', 'Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) < V2.9.2', 'Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) < V4.5.0', 'Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)', 'Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)']

Name

['Siemens SIMATIC Drive Controller family < V2.9.2', 'Siemens SIMATIC S7-1500 Software Controller', 'Siemens SIMATIC S7-PLCSIM Advanced', 'Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) < V2.9.2', 'Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) < V4.5.0', 'Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)', 'Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-15782"
    }
  },
  "description": "Siemens SIMATIC S7-1200\u548cS7-1500 CPU\u7cfb\u5217\u4ea7\u54c1\u8bbe\u8ba1\u7528\u4e8e\u5de5\u4e1a\u73af\u5883\u4e2d\u7684\u79bb\u6563\u548c\u8fde\u7eed\u63a7\u5236\uff0c\u5982\u5168\u7403\u5236\u9020\u4e1a\u3001\u98df\u54c1\u548c\u996e\u6599\u4ee5\u53ca\u5316\u5b66\u5de5\u4e1a\u3002\n\nSiemens SIMATIC S7-1200\u548cS7-1500 CPU\u7cfb\u5217\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u672a\u7ecf\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5c06\u4efb\u610f\u6570\u636e\u548c\u4ee3\u7801\u5199\u5165\u53d7\u4fdd\u62a4\u7684\u5185\u5b58\u533a\u57df\uff0c\u6216\u8bfb\u53d6\u654f\u611f\u6570\u636e\u4ee5\u53d1\u8d77\u8fdb\u4e00\u6b65\u7684\u653b\u51fb\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-37944",
  "openTime": "2021-05-31",
  "patchDescription": "Siemens SIMATIC S7-1200\u548cS7-1500 CPU\u7cfb\u5217\u4ea7\u54c1\u8bbe\u8ba1\u7528\u4e8e\u5de5\u4e1a\u73af\u5883\u4e2d\u7684\u79bb\u6563\u548c\u8fde\u7eed\u63a7\u5236\uff0c\u5982\u5168\u7403\u5236\u9020\u4e1a\u3001\u98df\u54c1\u548c\u996e\u6599\u4ee5\u53ca\u5316\u5b66\u5de5\u4e1a\u3002\r\n\r\nSiemens SIMATIC S7-1200\u548cS7-1500 CPU\u7cfb\u5217\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u672a\u7ecf\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5c06\u4efb\u610f\u6570\u636e\u548c\u4ee3\u7801\u5199\u5165\u53d7\u4fdd\u62a4\u7684\u5185\u5b58\u533a\u57df\uff0c\u6216\u8bfb\u53d6\u654f\u611f\u6570\u636e\u4ee5\u53d1\u8d77\u8fdb\u4e00\u6b65\u7684\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SIMATIC S7-1200\u548cS7-1500 CPU\u7cfb\u5217\u5185\u5b58\u4fdd\u62a4\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC Drive Controller family \u003c V2.9.2",
      "Siemens SIMATIC S7-1500 Software Controller",
      "Siemens SIMATIC S7-PLCSIM Advanced",
      "Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) \u003c V2.9.2",
      "Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants) \u003c V4.5.0",
      "Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)",
      "Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2021-05-31",
  "title": "Siemens SIMATIC S7-1200\u548cS7-1500 CPU\u7cfb\u5217\u5185\u5b58\u4fdd\u62a4\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2020-15782 (GCVE-0-2020-15782)

Vulnerability from cvelistv5

Published

2021-05-28 16:10

Modified

2024-08-04 13:22

Severity ?

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Summary

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions < V6.15), SINUMERIK ONE (All versions < V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf	x_refsource_MISC
	https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Siemens

SIMATIC Drive Controller family

Version: All versions < V2.9.2

Siemens	SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)	Version: All versions
Siemens	SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)	Version: All versions < V21.9
Siemens	SIMATIC S7-1200 CPU family (incl. SIPLUS variants)	Version: All versions < V4.5.0
Siemens	SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)	Version: All versions < V2.9.2
Siemens	SIMATIC S7-1500 Software Controller	Version: All versions < V21.9
Siemens	SIMATIC S7-PLCSIM Advanced	Version: All versions < V4.0
Siemens	SINAMICS PERFECT HARMONY GH180 Drives	Version: Drives manufactured before 2021-08-13
Siemens	SINUMERIK MC	Version: All versions < V6.15
Siemens	SINUMERIK ONE	Version: All versions < V6.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:22:30.758Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SIMATIC Drive Controller family",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V2.9.2"
            }
          ]
        },
        {
          "product": "SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "product": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V21.9"
            }
          ]
        },
        {
          "product": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V4.5.0"
            }
          ]
        },
        {
          "product": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V2.9.2"
            }
          ]
        },
        {
          "product": "SIMATIC S7-1500 Software Controller",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V21.9"
            }
          ]
        },
        {
          "product": "SIMATIC S7-PLCSIM Advanced",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V4.0"
            }
          ]
        },
        {
          "product": "SINAMICS PERFECT HARMONY GH180 Drives",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "Drives manufactured before 2021-08-13"
            }
          ]
        },
        {
          "product": "SINUMERIK MC",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V6.15"
            }
          ]
        },
        {
          "product": "SINUMERIK ONE",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V6.15"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003c V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions \u003c V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003c V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003c V2.9.2), SIMATIC S7-1500 Software Controller (All versions \u003c V21.9), SIMATIC S7-PLCSIM Advanced (All versions \u003c V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions \u003c V6.15), SINUMERIK ONE (All versions \u003c V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-14T10:47:06",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2020-15782",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SIMATIC Drive Controller family",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V2.9.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V21.9"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V4.5.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V2.9.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SIMATIC S7-1500 Software Controller",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V21.9"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SIMATIC S7-PLCSIM Advanced",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V4.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SINAMICS PERFECT HARMONY GH180 Drives",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Drives manufactured before 2021-08-13"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SINUMERIK MC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V6.15"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SINUMERIK ONE",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V6.15"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003c V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions \u003c V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003c V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003c V2.9.2), SIMATIC S7-1500 Software Controller (All versions \u003c V21.9), SIMATIC S7-PLCSIM Advanced (All versions \u003c V4.0), SINAMICS PERFECT HARMONY GH180 Drives (Drives manufactured before 2021-08-13), SINUMERIK MC (All versions \u003c V6.15), SINUMERIK ONE (All versions \u003c V6.15). Affected devices are vulnerable to a memory protection bypass through a specific operation. A remote unauthenticated attacker with network access to port 102/tcp could potentially write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434534.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-434535.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2020-15782",
    "datePublished": "2021-05-28T16:10:10",
    "dateReserved": "2020-07-15T00:00:00",
    "dateUpdated": "2024-08-04T13:22:30.758Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted