ICSA-18-060-01
Vulnerability from csaf_cisa
Published
2018-03-01 00:00
Modified
2018-04-19 00:00
Summary
ICSA-18-060-01_Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)

Notes

CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Summary
Siemens ProductCERT reported the vulnerabilities to NCCIC.
Exploitability
No known public exploits specifically target these vulnerabilities.


To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting the vulnerabilities to NCCIC"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "summary",
        "text": "Siemens ProductCERT reported the vulnerabilities to NCCIC.",
        "title": "Summary"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "CISAservicedesk@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-060-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2018/icsa-18-060-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-060-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-060-01"
      }
    ],
    "title": "ICSA-18-060-01_Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)",
    "tracking": {
      "current_release_date": "2018-04-19T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA USCert CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-18-060-01",
      "initial_release_date": "2018-03-01T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2018-03-01T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-18-060-01 Siemens SIMATIC, SIMOTION, and SINUMERIK"
        },
        {
          "date": "2018-04-19T00:00:00.000000Z",
          "legacy_version": "A",
          "number": "2",
          "summary": "ICSA-18-060-01 Siemens SIMATIC, SIMOTION, and SINUMERIK (Update A)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SINUMERIK PCU50.5-P WINXP: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINUMERIK PCU50.5-P WINXP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SINUMERIK PCU50.5-C WINXP: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "SINUMERIK PCU50.5-C WINXP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 17.0 ?.10",
                "product": {
                  "name": "SIMATIC IPC477D PRO: BIOS prior to V17.0?.10",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC477D PRO"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SINUMERIK PCU50.5-C WIN7: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "SINUMERIK PCU50.5-C WIN7"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.1.41.3024",
                "product": {
                  "name": "SIMATIC IPC647D: ME prior to V9.1.41.3024",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC647D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.1.41.3024",
                "product": {
                  "name": "SIMATIC IPC847D: ME prior to V9.1.41.3024",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC847D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SIMATIC IPC627C: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC627C"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SINUMERIK PCU50.5-P WIN7: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "SINUMERIK PCU50.5-P WIN7"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 11.8.50.3425 (ME) | \u003c R1.21.0 (BIOS)",
                "product": {
                  "name": "SIMATIC IPC547G: ME prior to V11.8.50.3425 and BIOS prior to R1.21.0",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC547G"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c S17.02.06.83.1",
                "product": {
                  "name": "SIMOTION P320-4S: BIOS prior to S17.02.06.83.1",
                  "product_id": "CSAFPID-00010"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMOTION P320-4S"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SIMATIC IPC647C: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-00011"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC647C"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SIMATIC Field-PG M3: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-00012"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Field-PG M3"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 17.0 ?.10",
                "product": {
                  "name": "SIMATIC IPC477D: BIOS prior to V17.0?.10",
                  "product_id": "CSAFPID-00013"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC477D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.1.41.3024",
                "product": {
                  "name": "SIMATIC IPC677D: ME prior to V9.1.41.3024",
                  "product_id": "CSAFPID-00014"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC677D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 18.01.06",
                "product": {
                  "name": "SIMATIC Field-PG M4: BIOS prior to V18.01.06",
                  "product_id": "CSAFPID-00015"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Field-PG M4"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.1.41.3024",
                "product": {
                  "name": "SIMATIC IPC627D: ME prior to V9.1.41.3024",
                  "product_id": "CSAFPID-00016"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC627D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 23.01.03",
                "product": {
                  "name": "SIMATIC ITP1000: BIOS prior to V23.01.03",
                  "product_id": "CSAFPID-00017"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ITP1000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 7.1.91.3272",
                "product": {
                  "name": "SIMATIC IPC547D: ME prior to V7.1.91.3272",
                  "product_id": "CSAFPID-00018"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC547D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SIMATIC IPC847C: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-00019"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC847C"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 22.01.04",
                "product": {
                  "name": "SIMATIC Field-PG M5: BIOS prior to V22.01.04",
                  "product_id": "CSAFPID-00020"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Field-PG M5"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 21.01.07",
                "product": {
                  "name": "SIMATIC IPC477E: BIOS prior to V21.01.07",
                  "product_id": "CSAFPID-00021"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC477E"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 17.0 ?.10",
                "product": {
                  "name": "SIMATIC IPC427D: BIOS prior to V17.0?.10",
                  "product_id": "CSAFPID-00022"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC427D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.1.41.3024",
                "product": {
                  "name": "SIMATIC IPC827D: ME prior to V9.1.41.3024",
                  "product_id": "CSAFPID-00023"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC827D"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SIMATIC HMI IPC677C: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-00024"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC HMI IPC677C"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 21.01.07",
                "product": {
                  "name": "SIMATIC IPC427E: BIOS prior to V21.01.07",
                  "product_id": "CSAFPID-00025"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC427E"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 9.1.41.3024",
                "product": {
                  "name": "SIMATIC IPC547E: ME prior to V9.1.41.3024",
                  "product_id": "CSAFPID-00026"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC547E"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 6.2.61.3535",
                "product": {
                  "name": "SIMATIC IPC827C: ME prior to V6.2.61.3535",
                  "product_id": "CSAFPID-00027"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC827C"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-5705",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Multiple buffer overflows could allow attackers to execute arbitrary code. Local access to the system is required to exploit this vulnerability. CVE-2017-5705, CVE-2017-5706, and CVE-2017-5707 have been assigned to these vulnerabilities. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on Industrial Security by Siemens",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ],
          "url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00012"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00015"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00020"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00024"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00022"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
          "product_ids": [
            "CSAFPID-00025"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
          "product_ids": [
            "CSAFPID-00013"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477E:  Update to V21.01.07 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00021"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00018"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00026"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00016"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00011"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00014"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00027"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00023"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00019"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00017"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00012"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ]
        }
      ],
      "title": "CVE-2017-5705"
    },
    {
      "cve": "CVE-2017-5706",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A buffer overflow could allow remote authenticated attackers to execute arbitrary code with extended privileges.CVE-2017-5712 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on Industrial Security by Siemens",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ],
          "url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00012"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00015"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00020"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00024"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00022"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
          "product_ids": [
            "CSAFPID-00025"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
          "product_ids": [
            "CSAFPID-00013"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477E:  Update to V21.01.07 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00021"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00018"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00026"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00016"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00011"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00014"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00027"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00023"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00019"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00017"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00012"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
        }
      ],
      "title": "CVE-2017-5706"
    },
    {
      "cve": "CVE-2017-5707",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Multiple privilege escalations could allow unauthenticated access to sensitive data.CVE-2017-5708, CVE-2017-5709, and CVE-2017-5710  have been assigned to these vulnerabilities. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends users configure the environment according to Siemens\u0027 Operational Guidelines for Industrial Security, and follow the recommendations in the product manuals. See the Operational Guidelines for Industrial Security",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ],
          "url": "https://www.siemens.com/cert/operational-guidelines-industrial-security"
        },
        {
          "category": "mitigation",
          "details": "Additional information on Industrial Security by Siemens",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018",
            "CSAFPID-00019",
            "CSAFPID-00020",
            "CSAFPID-00021",
            "CSAFPID-00022",
            "CSAFPID-00023",
            "CSAFPID-00024",
            "CSAFPID-00025",
            "CSAFPID-00026",
            "CSAFPID-00027"
          ],
          "url": "https://www.siemens.com/global/en/home/company/topic-areas/future-of-manufacturing/industrial-security.html"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M3: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00012"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48791866"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M4: Update to V18.01.06 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00015"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037537"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC Field-PG M5: Update to V22.01.04 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00020"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109738122"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC HMI IPC677C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00024"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC427D: Update to V17.0?.10 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00022"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC427E: Update to V21.01.07 or higher, which can located here",
          "product_ids": [
            "CSAFPID-00025"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477D: Update to V17.0?.10 or higher, which can located here",
          "product_ids": [
            "CSAFPID-00013"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477D PRO: Update to V17.0?.10 or higher, which can located here",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/108608500"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC477E:  Update to V21.01.07 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00021"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109742593"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547D: Update to V7.1.91.3272 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00018"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/67329515"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547E: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00026"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109481624"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC547G: Update to V11.8.50.3425 and R1.21.0 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109750349"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC627C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC627D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00016"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC647C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00011"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC647D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC677D: Install V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00014"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC827C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00027"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC827D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00023"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109474954"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC847C: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00019"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792076"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC IPC847D: Update to V9.1.41.3024 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109037779"
        },
        {
          "category": "vendor_fix",
          "details": "SIMATIC ITP1000: Update to V23.01.03 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00017"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109748173"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-C, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087%20"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-C, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-P, WIN7: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SINUMERIK PCU50.5-P, WINXP: Update to V6.2.61.3535 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/48792087"
        },
        {
          "category": "vendor_fix",
          "details": "SIMOTION P320-4S: Update to S17.02.06.83.1 or higher, which can be located here",
          "product_ids": [
            "CSAFPID-00012"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/%20view/109756438"
        }
      ],
      "title": "CVE-2017-5707"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.