ssa-223353
Vulnerability from csaf_siemens
Published
2022-03-08 00:00
Modified
2022-03-08 00:00
Summary
SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400

Notes

Summary
Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. SIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below. Siemens has released an update for the SIMOTICS CONNECT 400 and recommends to update to the latest version.
General Recommendations
As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.
Additional Resources
For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Terms of Use
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.


To clipboard 

{
  "document": {
    "category": "Siemens Security Advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "Multiple vulnerabilities (also known as \u201cNUCLEUS:13\u201d) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf.\n\nSIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below.\n\nSiemens has released an update for the SIMOTICS CONNECT 400 and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-223353.txt"
      },
      {
        "category": "self",
        "summary": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-223353.json"
      }
    ],
    "title": "SSA-223353: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400",
    "tracking": {
      "current_release_date": "2022-03-08T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-223353",
      "initial_release_date": "2022-03-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-03-08T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V0.5.0.0",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V1.0.0.0",
                "product": {
                  "name": "SIMOTICS CONNECT 400",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTICS CONNECT 400"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-31344",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-31344 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31344 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31344 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31344.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "title": "CVE-2021-31344"
    },
    {
      "cve": "CVE-2021-31346",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-31346 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31346 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31346 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31346.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "title": "CVE-2021-31346"
    },
    {
      "cve": "CVE-2021-31889",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-31889 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31889 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31889.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2021-31889"
    },
    {
      "cve": "CVE-2021-31890",
      "cwe": {
        "id": "CWE-240",
        "name": "Improper Handling of Inconsistent Structural Elements"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "references": [
        {
          "summary": "CVE-2021-31890 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31890 - SIMOTICS CONNECT 400",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "summary": "CVE-2021-31890 Mitre 5.0 json",
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31890.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V0.5.0.0 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0.0.0 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109778383/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "title": "CVE-2021-31890"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.