{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability has been identified in the OPC UA server of several\nindustrial  products. The vulnerability could cause a denial of\nservice condition on the  service or the device.    Siemens has\nreleased updates for several affected products and recommends to\nupdate to the latest versions. Siemens recommends specific\ncountermeasures for products where updates are not, or not yet\navailable.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect\nnetwork access to devices with appropriate mechanisms. In order to\noperate the devices in a protected IT environment, Siemens recommends\nto configure the environment according to Siemens' operational\nguidelines for Industrial Security (Download:\nhttps://www.siemens.com/cert/operational-guidelines-industrial-\nsecurity), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found\nat: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-307392: Denial of Service in OPC UA in Industrial Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-307392: Denial of Service in OPC UA in Industrial Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-307392.txt"
      },
      {
        "category": "self",
        "summary": "SSA-307392: Denial of Service in OPC UA in Industrial Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-307392.json"
      }
    ],
    "title": "SSA-307392: Denial of Service in OPC UA in Industrial Products",
    "tracking": {
      "current_release_date": "2022-08-09T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-307392",
      "initial_release_date": "2019-04-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2019-04-09T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2019-05-14T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Clarify productnames for SIMATIC HMI Products, added solution for SIMATIC S7-1500 CPU family, modified affected versions for SIMATIC Net PC Software"
        },
        {
          "date": "2019-06-11T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added update for SIMATIC Software Controller and SIMATIC ET 200 SP Open Controller CPU 1515SP PC2"
        },
        {
          "date": "2019-07-09T00:00:00Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Added update for SIMATIC RF600R, SIMATIC RF188C and SINEMA Server"
        },
        {
          "date": "2020-01-14T00:00:00Z",
          "legacy_version": "1.4",
          "number": "5",
          "summary": "Added updates for SIMATIC Panels and SIMATIC WinCC Runtime Advanced. SIPLUS devices now explicitly mentioned in the list of affected products"
        },
        {
          "date": "2020-02-11T00:00:00Z",
          "legacy_version": "1.5",
          "number": "6",
          "summary": "Added updates for SIMATIC NET PC Software"
        },
        {
          "date": "2020-03-10T00:00:00Z",
          "legacy_version": "1.6",
          "number": "7",
          "summary": "Added updates for SIMATIC IPC DiagMonitor and SINEC"
        },
        {
          "date": "2022-02-08T00:00:00Z",
          "legacy_version": "1.7",
          "number": "8",
          "summary": "No remediation planned for SIMATIC CP 443-1 OPC UA"
        },
        {
          "date": "2022-04-12T00:00:00Z",
          "legacy_version": "1.8",
          "number": "9",
          "summary": "Added solution for SIMATIC NET PC Software V14 and clarified affected versions; no remediation planned for V15"
        },
        {
          "date": "2022-08-09T00:00:00Z",
          "legacy_version": "1.9",
          "number": "10",
          "summary": "Added fix for TeleControl Server Basic"
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC CP 443-1 OPC UA",
                  "product_id": "1",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GK7443-1UX00-0XE0"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC CP 443-1 OPC UA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V2.7",
                "product": {
                  "name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V15.1 Upd 4",
                "product": {
                  "name": "SIMATIC HMI Comfort Outdoor Panels 7\" & 15\" (incl. SIPLUS variants)",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC HMI Comfort Outdoor Panels 7\" & 15\" (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V15.1 Upd 4",
                "product": {
                  "name": "SIMATIC HMI Comfort Panels 4\" - 22\" (incl. SIPLUS variants)",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC HMI Comfort Panels 4\" - 22\" (incl. SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V15.1 Upd 4",
                "product": {
                  "name": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V5.1.3",
                "product": {
                  "name": "SIMATIC IPC DiagMonitor",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC IPC DiagMonitor"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC NET PC Software V13",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC NET PC Software V13"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V14 SP1 Update 14",
                "product": {
                  "name": "SIMATIC NET PC Software V14",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC NET PC Software V14"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SIMATIC NET PC Software V15",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC NET PC Software V15"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V1.1.0",
                "product": {
                  "name": "SIMATIC RF188C",
                  "product_id": "10",
                  "product_identification_helper": {
                    "model_numbers": [
                      "6GT2002-0JE40"
                    ]
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC RF188C"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V3.2.1",
                "product": {
                  "name": "SIMATIC RF600R family",
                  "product_id": "11"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC RF600R family"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": ">= V2.5 < V2.6.1",
                "product": {
                  "name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions between V2.5 (including) and V2.7 (excluding)",
                "product": {
                  "name": "SIMATIC S7-1500 Software Controller",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC S7-1500 Software Controller"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V3.15 P018",
                "product": {
                  "name": "SIMATIC WinCC OA",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC OA"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V15.1 Upd 4",
                "product": {
                  "name": "SIMATIC WinCC Runtime Advanced",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC WinCC Runtime Advanced"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V1.0 SP1",
                "product": {
                  "name": "SINEC NMS",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC NMS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V14 SP2",
                "product": {
                  "name": "SINEMA Server",
                  "product_id": "17"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEMA Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V2.1",
                "product": {
                  "name": "SINUMERIK OPC UA Server",
                  "product_id": "18"
                }
              }
            ],
            "category": "product_name",
            "name": "SINUMERIK OPC UA Server"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "< V3.1.1",
                "product": {
                  "name": "TeleControl Server Basic",
                  "product_id": "19"
                }
              }
            ],
            "category": "product_name",
            "name": "TeleControl Server Basic"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-6575",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Specially crafted network packets sent to affected devices on port 4840/tcp\r\ncould allow an unauthenticated remote attacker to cause a denial of service\r\ncondition of the OPC communication or crash the device.\r\n\r\nThe security vulnerability could be exploited by an attacker with network\r\naccess to the affected systems. Successful exploitation requires no system\r\nprivileges and no user interaction. An attacker could use the vulnerability\r\nto compromise availability of the OPC communication.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "11",
          "12",
          "13",
          "14",
          "15",
          "16",
          "17",
          "18",
          "19"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Deactivate the OPC UA Service if supported by the product",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use VPN for protecting network communication between cells",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Currently no fix is planned",
          "product_ids": [
            "1",
            "7",
            "9"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.15 P018 or later version",
          "product_ids": [
            "14"
          ],
          "url": "https://www.winccoa.com/downloads/category/versions-\npatches.html"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V14 SP2 or later version",
          "product_ids": [
            "17"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109767382"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0 SP1 or later version",
          "product_ids": [
            "16"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109776939"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.7 or later version",
          "product_ids": [
            "13"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109478528"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.1 or later version",
          "product_ids": [
            "18"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109746207"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.1.1 or later version",
          "product_ids": [
            "19"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109812231/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V15.1 Upd 4 or later version",
          "product_ids": [
            "15"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109763891"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V5.1.3 or later version",
          "product_ids": [
            "6"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109763202"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.1.0 or later version",
          "product_ids": [
            "10"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109768507"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V3.2.1 or later version",
          "product_ids": [
            "11"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109768501"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.6.1 or later version",
          "product_ids": [
            "12"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109478459/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V15.1 Upd4 or later version",
          "product_ids": [
            "3",
            "4",
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109763890"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.7 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109759122"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V14 SP1 Update 14 or later version",
          "product_ids": [
            "8"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109807351/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "11",
            "12",
            "13",
            "14",
            "15",
            "16",
            "17",
            "18",
            "19"
          ]
        }
      ],
      "title": "CVE-2019-6575"
    }
  ]
}