Starting from 2024-11-06, new Terms of Use apply to all new and updated Siemens Security Advisories (SSA) and Bulletins (SSB), which now explicitly allow e.g. the commercial redistribution and modification of the advisories under certain circumstances. For details see Advisories Terms of Use.
Enhancing Siemens Security Advisories: A User-Friendly Approach
In the dynamic world of cybersecurity, Siemens has been on a journey to improve its security advisories. These enhancements aim to benefit both technical and non-technical users. Here are the key milestones of this improvement and their impact.
Siemens is aware of the talk at the Black Hat Conference Europe (December 6, 2023, London), titled “A Decade After Stuxnet: How Siemens S7 is Still an Attacker’s Heaven”. The talk and the related research paper describe the details of the legacy PG/PC and HMI communication protocol as used between TIA Portal / HMIs and SIMATIC S7-1500 SW Controller in versions before V17. No previously unknown security vulnerabilities were disclosed in this talk. Siemens was in close coordination with the presenting company.
Starting today, Siemens ProductCERT will no longer maintain the Twitter feed and delete the account in the following weeks.
This article written by ETM, the company that develops SIMATIC WinCC OA, provides additional insights related to SSA-111512:
On April 6, 2022, "FORESCOUT Vedere Labs" informed us about the intended publication of an article dubbed "OT:ICEFALL" mentioning two vulnerabilities regarding WinCC OA:
ETM immediately analyzed the claims made in these reports. Based on our level of information, they are based on WinCC Open Architecture (OA) version 3.15.
On March 10, 2022, a researcher dubbed "RoseSecurity", published an exploit on PacketStorm, titled "Siemens S7-1200 4.5 Unauthenticated Access". The exploit is demonstrated by curl commands that show how CPU start/stop commands can be triggered on Siemens S7-1200 devices without prior authentication.
Siemens ProductCERT introduced new formats - namely HTML and CSAF - for its security advisories and will phase out the traditional formats (PDF, TXT, and CVRF) over time. This article gives a short overview on the reasoning behind this decision and what the future brings.
Siemens is aware of the security vulnerability in the Spring Framework (CVE-2022-22965), also referred to as "SpringShell", or "Spring4Shell".
For Siemens products, a security advisory (SSA-254054) was issued on 2022-04-19 and will be updated in the following days as more information becomes available.
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' Operational Guidelines for Industrial Security, and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Siemens is aware of the security vulnerabilities in Apache Log4j (CVE-2021-44228 and CVE-2021-45046), also named "Log4Shell". For Siemens products, a security advisory (SSA-661247) was issued on 2021-12-13 and will be updated in the following days as more information becomes available.