{ "document": { "title": "SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices", "category": "Siemens Security Advisory", "csaf_version": "2.0", "publisher": { "name": "Siemens ProductCERT", "contact_details": "productcert@siemens.com", "category": "vendor", "namespace": "https://www.siemens.com" }, "distribution": { "text": "Disclosure is not limited.", "tlp": { "label": "WHITE" } }, "tracking": { "id": "SSA-845392", "status": "final", "version": "1", "revision_history": [ { "number": "1", "legacy_version": "1.0", "date": "2022-01-11T00:00:00Z", "summary": "Publication Date" } ], "initial_release_date": "2022-01-11T00:00:00Z", "current_release_date": "2022-01-11T00:00:00Z", "generator": { "engine": { "name": "Siemens ProductCERT CSAF Generator", "version": "1" } } }, "notes": [ { "title": "Summary", "category": "summary", "text": "Multiple vulnerabilities (also known as \"NUCLEUS:13\") have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf.\n\nPLUSCONTROL 1st Gen devices are affected by some of the vulnerabilities as documented below.\n\nSiemens Energy recommends specific countermeasures for products where updates are not available." }, { "title": "General Recommendations", "category": "general", "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid's reliability can thus be minimized by virtue of the grid design.\n\nSiemens Energy strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens Energy strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment.\n\nAs a general security measure Siemens Energy strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment." }, { "title": "Additional Resources", "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories" }, { "title": "Terms of Use", "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use." } ], "references": [ { "category": "self", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf", "summary": "SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices - PDF Version" }, { "category": "self", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-845392.txt", "summary": "SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices - TXT Version" }, { "category": "self", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-845392.json", "summary": "SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices - CSAF Version" } ] }, "product_tree": { "branches": [ { "name": "Siemens", "category": "vendor", "branches": [ { "name": "PLUSCONTROL 1st Gen", "category": "product_name", "branches": [ { "name": "vers:all/*", "category": "product_version_range", "product": { "product_id": "1", "name": "PLUSCONTROL 1st Gen" } } ] } ] } ] }, "vulnerabilities": [ { "title": "CVE-2021-31344", "notes": [ { "title": "Summary", "category": "summary", "text": "ICMP echo packets with fake IP options allow sending ICMP echo reply messages to arbitrary hosts on the network. (FSMD-2021-0004)" } ], "cve": "CVE-2021-31344", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type ('Type Confusion')" }, "product_status": { "known_affected": [ "1" ] }, "scores": [ { "cvss_v3": { "version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C" }, "products": [ "1" ] } ], "remediations": [ { "product_ids": [ "1" ], "category": "no_fix_planned", "details": "Currently no remediation is planned" }, { "product_ids": [ "1" ], "category": "mitigation", "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments." } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31344.json", "summary": "CVE-2021-31344 Mitre 5.0 json" } ] }, { "title": "CVE-2021-31345", "notes": [ { "title": "Summary", "category": "summary", "text": "The total length of an UDP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on a user-defined applications that runs on top of the UDP protocol. (FSMD-2021-0006)" } ], "cve": "CVE-2021-31345", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "product_status": { "known_affected": [ "1" ] }, "scores": [ { "cvss_v3": { "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C" }, "products": [ "1" ] } ], "remediations": [ { "product_ids": [ "1" ], "category": "no_fix_planned", "details": "Currently no remediation is planned" }, { "product_ids": [ "1" ], "category": "mitigation", "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments." } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31345.json", "summary": "CVE-2021-31345 Mitre 5.0 json" } ] }, { "title": "CVE-2021-31346", "notes": [ { "title": "Summary", "category": "summary", "text": "The total length of an ICMP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0007)" } ], "cve": "CVE-2021-31346", "cwe": { "id": "CWE-1284", "name": "Improper Validation of Specified Quantity in Input" }, "product_status": { "known_affected": [ "1" ] }, "scores": [ { "cvss_v3": { "version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C" }, "products": [ "1" ] } ], "remediations": [ { "product_ids": [ "1" ], "category": "no_fix_planned", "details": "Currently no remediation is planned" }, { "product_ids": [ "1" ], "category": "mitigation", "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments." } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31346.json", "summary": "CVE-2021-31346 Mitre 5.0 json" } ] }, { "title": "CVE-2021-31885", "notes": [ { "title": "Summary", "category": "summary", "text": "TFTP server application allows for reading the contents of the TFTP memory buffer via sending malformed TFTP commands. (FSMD-2021-0009)" } ], "cve": "CVE-2021-31885", "cwe": { "id": "CWE-805", "name": "Buffer Access with Incorrect Length Value" }, "product_status": { "known_affected": [ "1" ] }, "scores": [ { "cvss_v3": { "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C" }, "products": [ "1" ] } ], "remediations": [ { "product_ids": [ "1" ], "category": "no_fix_planned", "details": "Currently no remediation is planned" }, { "product_ids": [ "1" ], "category": "mitigation", "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments." } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31885.json", "summary": "CVE-2021-31885 Mitre 5.0 json" } ] }, { "title": "CVE-2021-31889", "notes": [ { "title": "Summary", "category": "summary", "text": "Malformed TCP packets with a corrupted SACK option leads to Information Leaks and Denial-of-Service conditions. (FSMD-2021-0015)" } ], "cve": "CVE-2021-31889", "cwe": { "id": "CWE-191", "name": "Integer Underflow (Wrap or Wraparound)" }, "product_status": { "known_affected": [ "1" ] }, "scores": [ { "cvss_v3": { "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" }, "products": [ "1" ] } ], "remediations": [ { "product_ids": [ "1" ], "category": "no_fix_planned", "details": "Currently no remediation is planned" }, { "product_ids": [ "1" ], "category": "mitigation", "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments." } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31889.json", "summary": "CVE-2021-31889 Mitre 5.0 json" } ] }, { "title": "CVE-2021-31890", "notes": [ { "title": "Summary", "category": "summary", "text": "The total length of an TCP payload (set in the IP header) is unchecked. This may lead to various side effects, including Information Leak and Denial-of-Service conditions, depending on the network buffer organization in memory. (FSMD-2021-0017)" } ], "cve": "CVE-2021-31890", "cwe": { "id": "CWE-240", "name": "Improper Handling of Inconsistent Structural Elements" }, "product_status": { "known_affected": [ "1" ] }, "scores": [ { "cvss_v3": { "version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C" }, "products": [ "1" ] } ], "remediations": [ { "product_ids": [ "1" ], "category": "no_fix_planned", "details": "Currently no remediation is planned" }, { "product_ids": [ "1" ], "category": "mitigation", "details": "PLUSCONTROL devices are typically located in a separate LAN segment of energy transmission solutions, where an attacker could use these vulnerabilities to disrupt SER messages or Trace functionalities. Therefore, review the status of the defense in depth recommendations that apply to your specific deployment and align as needed. Especially the measures on the network layer to prevent accessibility from other network segments." } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2021-31890.json", "summary": "CVE-2021-31890 Mitre 5.0 json" } ] } ] }