This updated advisory is a follow-up to the advisory update titled ICSA-21-131-03 Siemens Linux-based Products (Update I) that was published August 11, 2022, to the ICS webpage at www.cisa.gov/ics.
Successful exploitation of this vulnerability could compromise confidentiality and integrity.
The following Siemens Linux-based products are affected:
- RUGGEDCOM RM1224: All versions between v5.0 and v6.4
- SCALANCE M-800: All versions between v5.0 and v6.4
- SCALANCE S615: All versions between v5.0 and v6.4
- SCALANCE SC-600: All versions prior to v2.1.3
- SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0
- SIMATIC MV500 Family: All versions
- SIMATIC CP 1243-7 LTE EU: Versions 3.1.39 and later, and prior to Version 3.3
- SIMATIC CP 1243-7 LTE US: Versions 3.1.39 and later, and prior to Version 3.3
- SIMATIC CP 1242-7 GPRS V2: Versions 3.1.39 and prior to Version 3.3
- SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants): Versions 2.0 and later
- SIMATIC CP 1542SP-1: Versions 2.0 and later
- SIMATIC CP 1543-1 (incl. SIPLUS variants): Versions prior to 3.0
- SIMATIC CP 1543SP-1 (incl SIPLUS variants): Versions 2.0 and later
- SIMATIC CP 1545-1: All versions prior to v1.1
Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
- Where possible, apply the following countermeasures:
- Use name servers inside corporate environments.
- Restrict access of CLI and web-based management interfaces for the affected devices to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 where possible.
- Disable outgoing ICMP packets by using “service ACLs” to implement blocking rules.
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens operational guidelines for industrial security and following the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory SSA-324955
