icsa-20-105-06
Vulnerability from csaf_cisa
Published
2020-04-14 00:00
Modified
2022-05-12 00:00
Summary
ICSA-20-105-06_Siemens SIMOTICS, Desigo, APOGEE, and TALON (Update B)
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Risk evaluation
Successful exploitation of this vulnerability could allow an attacker to affect the availability and integrity of the device.
Exploitability
No known public exploits specifically target this vulnerability.
{
"document": {
"acknowledgments": [
{
"organization": "Siemens",
"summary": "reporting this vulnerability to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "summary",
"text": "Successful exploitation of this vulnerability could allow an attacker to affect the availability and integrity of the device.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "No known public exploits specifically target this vulnerability.",
"title": "Exploitability"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "CISAservicedesk@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-20-105-06 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-105-06.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-20-105-06 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-105-06"
}
],
"title": "ICSA-20-105-06_Siemens SIMOTICS, Desigo, APOGEE, and TALON (Update B)",
"tracking": {
"current_release_date": "2022-05-12T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA USCert CSAF Generator",
"version": "1"
}
},
"id": "ICSA-20-105-06",
"initial_release_date": "2020-04-14T00:00:00.000000Z",
"revision_history": [
{
"date": "2020-04-14T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-20-105-06 Siemens SIMOTICS, Desigo, APOGEE, and TALON"
},
{
"date": "2021-01-12T00:00:00.000000Z",
"legacy_version": "A",
"number": "2",
"summary": "ICSA-20-105-06 Siemens SIMOTICS, Desigo, APOGEE, and TALON (Update A)"
},
{
"date": "2021-12-16T00:00:00.000000Z",
"legacy_version": "B",
"number": "3",
"summary": "ICSA-20-105-06 Siemens SIMOTICS, Desigo, APOGEE, and TALON (Update B)"
},
{
"date": "2022-04-14T00:00:00.000000Z",
"legacy_version": "C",
"number": "4",
"summary": "ICSA-20-105-06 Siemens SIMOTICS, Desigo, APOGEE, and TALON (Update C)"
},
{
"date": "2022-05-12T00:00:00.000000Z",
"legacy_version": "D",
"number": "5",
"summary": "ICSA-20-105-06 Siemens SIMOTICS, Desigo, APOGEE, and TALON (Update D)"
}
],
"status": "final",
"version": "5"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC001-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "Desigo PXC001-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC100-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "Desigo PXC100-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 3.5.3",
"product": {
"name": "APOGEE PXC Series (BACnet): All versions prior to 3.5.3",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "APOGEE PXC Series (BACnet)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC200-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "Desigo PXC200-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXM20-E: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "Desigo PXM20-E"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 0.3.0.330",
"product": {
"name": "SIMOTICS CONNECT 400: All versions prior to 0.3.0.330",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "SIMOTICS CONNECT 400"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC36.1-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "Desigo PXC36.1-E.D"
},
{
"branches": [
{
"category": "product_version",
"name": "2.8.2 and 2.8.19",
"product": {
"name": "APOGEE PXC Series (P2): All versions between 2.8.2 and v2.8.19",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "APOGEE PXC Series (P2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC00-U: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "Desigo PXC00-U"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC00-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00010"
}
}
],
"category": "product_name",
"name": "Desigo PXC00-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC22-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00011"
}
}
],
"category": "product_name",
"name": "Desigo PXC22-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 2.8.2",
"product": {
"name": "APOGEE MEC/MBC/PXC (P2): All versions prior to 2.8.2",
"product_id": "CSAFPID-00012"
}
}
],
"category": "product_name",
"name": "APOGEE MEC/MBC/PXC (P2)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC12-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00013"
}
}
],
"category": "product_name",
"name": "Desigo PXC12-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC50-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00014"
}
}
],
"category": "product_name",
"name": "Desigo PXC50-E.D"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC128-U: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00015"
}
}
],
"category": "product_name",
"name": "Desigo PXC128-U"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c 3.5.3",
"product": {
"name": "TALON TC Series (BACnet): All versions prior to 3.5.3",
"product_id": "CSAFPID-00016"
}
}
],
"category": "product_name",
"name": "TALON TC Series (BACnet)"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC64-U: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00017"
}
}
],
"category": "product_name",
"name": "Desigo PXC64-U"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003e= 2.3x | \u003c= 6.00.327",
"product": {
"name": "Desigo PXC22.1-E.D: All versions 2.3x to v6.00.327",
"product_id": "CSAFPID-00018"
}
}
],
"category": "product_name",
"name": "Desigo PXC22.1-E.D"
}
],
"category": "vendor",
"name": "Siemens"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-13939",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"notes": [
{
"category": "summary",
"text": "The affected products could allow an attacker to change the IP address of the device to an invalid value. This may allow an attacker to make device configuration changes and affect its availability. CVE-2019-13939 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "Desigo Products: Update to v6.00.327",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0007",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00017",
"CSAFPID-00018"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109791941/"
},
{
"category": "vendor_fix",
"details": "SIMOTICS CONNECT 400: Update to v0.3.0.330",
"product_ids": [
"CSAFPID-0006"
],
"url": "https://support.industry.siemens.com/cs/ww/en/view/109778383"
},
{
"category": "vendor_fix",
"details": "TALON TC Series (BACnet): Update to v3.5.3",
"product_ids": [
"CSAFPID-00016"
],
"url": "https://support.industry.siemens.com/cs/ww/en/109778383"
},
{
"category": "vendor_fix",
"details": "APOGEE PXC Series (BACnet): Update to v3.5.3",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://support.industry.siemens.com/cs/ww/en/109778383"
},
{
"category": "vendor_fix",
"details": "APOGEE PXC Series (P2): Update to v2.8.19 or later (contact Siemens for assistance)",
"product_ids": [
"CSAFPID-0008",
"CSAFPID-00012"
],
"url": "https://www.siemens.com/cert/advisories"
},
{
"category": "mitigation",
"details": "Disable the DHCP client and use static IP address configuration instead (Note that the DHCP client is disabled by default on APOGEE/TALON and Desigo products).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018"
]
},
{
"category": "mitigation",
"details": "APOGEE MEC, MBC, PXC (versions prior to v2.8.2): Use static IP address configuration as described above",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0008",
"CSAFPID-00012"
]
},
{
"category": "mitigation",
"details": "APOGEE PXC Series and TALON TC Series products: If using a static IP address is not possible, update to the fix version listed above or contact your local Siemens office for support.",
"product_ids": [
"CSAFPID-0003",
"CSAFPID-0008",
"CSAFPID-00012",
"CSAFPID-00016"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018"
]
}
],
"title": "CVE-2019-13939"
}
]
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.