Siemens is aware of the recently disclosed set of security vulnerabilities in Treck, Inc.'s TCP/IP stack, known as Ripple20, disclosed by the JSOF research lab. Siemens experts had conducted an internal investigation to assess impact on Siemens products. No Siemens product is known to use Treck Inc.'s TCP/IP stack, or otherwise be affected by the reported vulnerabilities.
Siemens has released an updated version 2.1 of the Operational Guidelines for Industrial Security.
The guidelines provide recommendations for the secure operation of plant and machinery in industrial environments, including a 'Defense-in-Depth' security concept.
Version 2.1 replaces all former versions of the guidelines and is referenced in Siemens Security Advisories related with Siemens Industrial Products.
SIPLUS products are rebranded standard products offering improved resistance to mechanical loads, chemical and biological substances, condensation, and temperature fluctuations. They are also designed to cope with temperatures between -40° and +70° Celsius. These devices share the same firmware than the products they are based on.
Starting by October 15 all topics related to the Siemens Healthineers Cyber Security (including security advisories) will be published at the Siemens Healthineers Cyber Security webpage. Should you have further questions regarding this announcement, please use the contact form at the Siemens Healthineers Cyber Security webpage.
Siemens Healthineers is aware of the vulnerabilities in a number of Real Time Operating Systems (RTOSs) collectively known as URGENT/11, discovered by Armis. We also understand the topic in terms of how such vulnerabilities can possibly affect medical devices, as communicated in the recent Safety Communication from the US Food & Drug Administration (FDA).
Siemens ProductCERT is proud to be awarded by Kaspersky for our quality, transparent vulnerability management process. We thank Kaspersky for the recognition and are happy that our efforts are perceived that way.
Siemens Healthineers is aware of the reports about the vulnerabilities reported by Microsoft on August 13th, known as DejaBlue or CVE-2019-1181/1182. Microsoft released updates for Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions on 2019-08-13, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network.
Siemens is aware of the reports about the vulnerabilities reported by Microsoft on August 13th, known as DejaBlue or CVE-2019-1181/1182. Microsoft released updates for several supported Windows operating systems on 2019-08-13, which fix a vulnerability in the Remote Desktop Service. The vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the target system if the system exposes the service to the network.
Siemens is aware of the research from Technion Haifa and Tel-Aviv University presented at BlackHat USA 2019 as "Rogue7: Rogue Engineering-Station attacks on S7 Simatic PLCs". Siemens recommends to enable the feature "access protection" to prohibit unauthorized modifications of the devices.
Siemens takes the next step in improving the way vulnerabilities are communicated. Security advisories will be published on the second Tuesday of the month to support our customers the best we can in planning resources and maintenance windows. Publications out of band will only be performed in uncommon circumstances.