CNVD-2022-51634

Vulnerability from cnvd - Published: 2022-07-15
VLAI
Title
Siemens SIMATIC CP SRCS VPN Feature代码注入漏洞
Description
SIMATIC CP 1242-7和CP 1243-7 LTE通信处理器将SIMATIC S7-1200控制器连接到广域网 (WAN)。它们提供集成的安全功能，例如防火墙、虚拟专用网络 (VPN)，并支持其他带有数据加密的协议。SIMATIC CP 1243-8 IRC通信处理器通过SINAUT ST7遥控协议将SIMATIC S7-1200控制器连接到控制中心或ST7主站。SIMATIC CP 1543-1通信处理器将SIMATIC S7-1500控制器连接到以太网。它们提供集成的安全功能，例如防火墙、虚拟专用网络 (VPN)，并支持其他带有数据加密的协议。SIMATIC CP 1543SP-1、CP 1542SP-1 和 CP 1542SP-1 IRC通信处理器将SIMATIC ET 200SP控制器连接到以太网。SIMATIC CP 1543SP-1和CP 1542SP-1 IRC通信处理器还提供集成的安全功能，例如防火墙、虚拟专用网络 (VPN) 或支持其他数据加密协议。SIPLUSextreme产品专为在极端条件下可靠运行而设计，基于SIMATIC、LOGO!、SITOP、SINAMICS、SIMOTION、SCALANCE或其他设备。SIPLUS设备使用与其所基于的产品相同的固件。 Siemens SIMATIC CP SRCS VPN Feature存在代码注入漏洞，攻击者可利用该漏洞以提升的权限执行任意代码。
Severity
中
Patch Name
Siemens SIMATIC CP SRCS VPN Feature代码注入漏洞的补丁
Patch Description
SIMATIC CP 1242-7和CP 1243-7 LTE通信处理器将SIMATIC S7-1200控制器连接到广域网 (WAN)。它们提供集成的安全功能，例如防火墙、虚拟专用网络 (VPN)，并支持其他带有数据加密的协议。SIMATIC CP 1243-8 IRC通信处理器通过SINAUT ST7遥控协议将SIMATIC S7-1200控制器连接到控制中心或ST7主站。SIMATIC CP 1543-1通信处理器将SIMATIC S7-1500控制器连接到以太网。它们提供集成的安全功能，例如防火墙、虚拟专用网络 (VPN)，并支持其他带有数据加密的协议。SIMATIC CP 1543SP-1、CP 1542SP-1 和 CP 1542SP-1 IRC通信处理器将SIMATIC ET 200SP控制器连接到以太网。SIMATIC CP 1543SP-1和CP 1542SP-1 IRC通信处理器还提供集成的安全功能，例如防火墙、虚拟专用网络 (VPN) 或支持其他数据加密协议。SIPLUSextreme产品专为在极端条件下可靠运行而设计，基于SIMATIC、LOGO!、SITOP、SINAMICS、SIMOTION、SCALANCE或其他设备。SIPLUS设备使用与其所基于的产品相同的固件。 Siemens SIMATIC CP SRCS VPN Feature存在代码注入漏洞，攻击者可利用该漏洞以提升的权限执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/html/ssa-517377.html

Reference
https://cert-portal.siemens.com/productcert/html/ssa-517377.html
Impacted products
Name
['Siemens SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0)', 'Siemens SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0)', 'Siemens SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0)', 'Siemens SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0)', 'Siemens SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)', 'Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) >=2.0', 'Siemens SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) <3.0.22', 'Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) >=2.0', 'Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) >=2.0', 'Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) >=2.0', 'Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) >=2.0', 'Siemens SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0)', 'Siemens SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) <3.0.22', 'Siemens SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0)', 'Siemens SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0)']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-34821"
    }
  },
  "description": "SIMATIC CP 1242-7\u548cCP 1243-7 LTE\u901a\u4fe1\u5904\u7406\u5668\u5c06SIMATIC S7-1200\u63a7\u5236\u5668\u8fde\u63a5\u5230\u5e7f\u57df\u7f51 (WAN)\u3002\u5b83\u4eec\u63d0\u4f9b\u96c6\u6210\u7684\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982\u9632\u706b\u5899\u3001\u865a\u62df\u4e13\u7528\u7f51\u7edc (VPN)\uff0c\u5e76\u652f\u6301\u5176\u4ed6\u5e26\u6709\u6570\u636e\u52a0\u5bc6\u7684\u534f\u8bae\u3002SIMATIC CP 1243-8 IRC\u901a\u4fe1\u5904\u7406\u5668\u901a\u8fc7SINAUT ST7\u9065\u63a7\u534f\u8bae\u5c06SIMATIC S7-1200\u63a7\u5236\u5668\u8fde\u63a5\u5230\u63a7\u5236\u4e2d\u5fc3\u6216ST7\u4e3b\u7ad9\u3002SIMATIC CP 1543-1\u901a\u4fe1\u5904\u7406\u5668\u5c06SIMATIC S7-1500\u63a7\u5236\u5668\u8fde\u63a5\u5230\u4ee5\u592a\u7f51\u3002\u5b83\u4eec\u63d0\u4f9b\u96c6\u6210\u7684\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982\u9632\u706b\u5899\u3001\u865a\u62df\u4e13\u7528\u7f51\u7edc (VPN)\uff0c\u5e76\u652f\u6301\u5176\u4ed6\u5e26\u6709\u6570\u636e\u52a0\u5bc6\u7684\u534f\u8bae\u3002SIMATIC CP 1543SP-1\u3001CP 1542SP-1 \u548c CP 1542SP-1 IRC\u901a\u4fe1\u5904\u7406\u5668\u5c06SIMATIC ET 200SP\u63a7\u5236\u5668\u8fde\u63a5\u5230\u4ee5\u592a\u7f51\u3002SIMATIC CP 1543SP-1\u548cCP 1542SP-1 IRC\u901a\u4fe1\u5904\u7406\u5668\u8fd8\u63d0\u4f9b\u96c6\u6210\u7684\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982\u9632\u706b\u5899\u3001\u865a\u62df\u4e13\u7528\u7f51\u7edc (VPN) \u6216\u652f\u6301\u5176\u4ed6\u6570\u636e\u52a0\u5bc6\u534f\u8bae\u3002SIPLUSextreme\u4ea7\u54c1\u4e13\u4e3a\u5728\u6781\u7aef\u6761\u4ef6\u4e0b\u53ef\u9760\u8fd0\u884c\u800c\u8bbe\u8ba1\uff0c\u57fa\u4e8eSIMATIC\u3001LOGO!\u3001SITOP\u3001SINAMICS\u3001SIMOTION\u3001SCALANCE\u6216\u5176\u4ed6\u8bbe\u5907\u3002SIPLUS\u8bbe\u5907\u4f7f\u7528\u4e0e\u5176\u6240\u57fa\u4e8e\u7684\u4ea7\u54c1\u76f8\u540c\u7684\u56fa\u4ef6\u3002\n\nSiemens SIMATIC CP SRCS VPN Feature\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u63d0\u5347\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-517377.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-51634",
  "openTime": "2022-07-15",
  "patchDescription": "SIMATIC CP 1242-7\u548cCP 1243-7 LTE\u901a\u4fe1\u5904\u7406\u5668\u5c06SIMATIC S7-1200\u63a7\u5236\u5668\u8fde\u63a5\u5230\u5e7f\u57df\u7f51 (WAN)\u3002\u5b83\u4eec\u63d0\u4f9b\u96c6\u6210\u7684\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982\u9632\u706b\u5899\u3001\u865a\u62df\u4e13\u7528\u7f51\u7edc (VPN)\uff0c\u5e76\u652f\u6301\u5176\u4ed6\u5e26\u6709\u6570\u636e\u52a0\u5bc6\u7684\u534f\u8bae\u3002SIMATIC CP 1243-8 IRC\u901a\u4fe1\u5904\u7406\u5668\u901a\u8fc7SINAUT ST7\u9065\u63a7\u534f\u8bae\u5c06SIMATIC S7-1200\u63a7\u5236\u5668\u8fde\u63a5\u5230\u63a7\u5236\u4e2d\u5fc3\u6216ST7\u4e3b\u7ad9\u3002SIMATIC CP 1543-1\u901a\u4fe1\u5904\u7406\u5668\u5c06SIMATIC S7-1500\u63a7\u5236\u5668\u8fde\u63a5\u5230\u4ee5\u592a\u7f51\u3002\u5b83\u4eec\u63d0\u4f9b\u96c6\u6210\u7684\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982\u9632\u706b\u5899\u3001\u865a\u62df\u4e13\u7528\u7f51\u7edc (VPN)\uff0c\u5e76\u652f\u6301\u5176\u4ed6\u5e26\u6709\u6570\u636e\u52a0\u5bc6\u7684\u534f\u8bae\u3002SIMATIC CP 1543SP-1\u3001CP 1542SP-1 \u548c CP 1542SP-1 IRC\u901a\u4fe1\u5904\u7406\u5668\u5c06SIMATIC ET 200SP\u63a7\u5236\u5668\u8fde\u63a5\u5230\u4ee5\u592a\u7f51\u3002SIMATIC CP 1543SP-1\u548cCP 1542SP-1 IRC\u901a\u4fe1\u5904\u7406\u5668\u8fd8\u63d0\u4f9b\u96c6\u6210\u7684\u5b89\u5168\u529f\u80fd\uff0c\u4f8b\u5982\u9632\u706b\u5899\u3001\u865a\u62df\u4e13\u7528\u7f51\u7edc (VPN) \u6216\u652f\u6301\u5176\u4ed6\u6570\u636e\u52a0\u5bc6\u534f\u8bae\u3002SIPLUSextreme\u4ea7\u54c1\u4e13\u4e3a\u5728\u6781\u7aef\u6761\u4ef6\u4e0b\u53ef\u9760\u8fd0\u884c\u800c\u8bbe\u8ba1\uff0c\u57fa\u4e8eSIMATIC\u3001LOGO!\u3001SITOP\u3001SINAMICS\u3001SIMOTION\u3001SCALANCE\u6216\u5176\u4ed6\u8bbe\u5907\u3002SIPLUS\u8bbe\u5907\u4f7f\u7528\u4e0e\u5176\u6240\u57fa\u4e8e\u7684\u4ea7\u54c1\u76f8\u540c\u7684\u56fa\u4ef6\u3002\r\n\r\nSiemens SIMATIC CP SRCS VPN Feature\u5b58\u5728\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u63d0\u5347\u7684\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SIMATIC CP SRCS VPN Feature\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0)",
      "Siemens SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0)",
      "Siemens SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0)",
      "Siemens SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0)",
      "Siemens SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)",
      "Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) \u003e=2.0",
      "Siemens SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) \u003c3.0.22",
      "Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) \u003e=2.0",
      "Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) \u003e=2.0",
      "Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) \u003e=2.0",
      "Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) \u003e=2.0",
      "Siemens SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0)",
      "Siemens SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) \u003c3.0.22",
      "Siemens SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0)",
      "Siemens SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0)"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-517377.html",
  "serverity": "\u4e2d",
  "submitTime": "2022-07-15",
  "title": "Siemens SIMATIC CP SRCS VPN Feature\u4ee3\u7801\u6ce8\u5165\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.