Publication Date: |
|
Last Update: |
|
Current Version: | V3.0 |
CVSS v3.1 Base Score: | 10.0 |
Affected Product and Versions | Remediation |
---|---|
All versions < 2021-12-13 |
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
|
All versions < V6.3 |
Update to V6.3 or later version
|
All versions < V3.0.30 |
Update to V3.0.30 or later version
|
All versions < V3.0.29 |
Update to V3.0.29 or later version
|
All versions |
Vulnerability CVE-2021-44228 fixed on central cloud service; no user actions necessary
|
All versions >= V2019.1 SP1912 < V2019.1 SP2204 only if Teamcenter integration feature is used |
Update to V2019.1 SP2204 or later version
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions < 2020.1 SP2202 only if Teamcenter integration feature is used |
Update to V2020.1 SP2202 or later version
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions < V2021.1 SP2202 only if Teamcenter integration feature is used |
Update to V2021.1 SP2202 or later version
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions < V10.4.2 only if Teamcenter PDI feature is used |
Update to V10.4.2 or later version
|
All versions < V13.17.2 |
Update to V13.17.2 was deployed on all cRSP services on 2021-12-21; no user actions necessary
Note: Earlier versions of the product contained a vulnerable version of log4j, but no risk for exploitation could be identified.
|
All versions < V1.7.18 |
Update to V1.7.18 or later version, as provided via cRSP V13.17.2 or later version
Note: Earlier versions of the product contained a vulnerable version of log4j, but no risk for exploitation could be identified.
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions with Advanced Reporting EM installed |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805562/
|
All versions < V5.1 QU1 with Advanced Reporting EM installed |
Update to V5.1 QU1 or later version
|
All versions < 2021-12-13 |
Vulnerability CVE-2021-44228 fixed on central cloud service starting 2021-12-13; no user actions necessary
|
V3.1 |
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/EnergyIP+Security+Advisory+for+Log4Shell+Vulnerability
|
V8.5, V8.6, V8.7, V9.0 |
Find detailed remediation and mitigation information on the EnergyIP docs portal at: https://docs.emeter.com/display/public/WELCOME/EnergyIP+Security+Advisory+for+Log4Shell+Vulnerability
Note: EnergyIP V8.5 and V8.6 applications are not directly affected, but CAS is.
|
All versions < V3.8.0.12 only affected by CVE-2021-44228 |
Update to V3.8.0.12 or later version
|
All versions < 2021-12-10 |
Vulnerabilities fixed on central cloud services starting 2021-12-10; no user actions necessary
For Comfy and Enlighted, see also chapter Additional Information below
|
All versions < 2021-12-11 |
Vulnerabilities fixed on central cloud services starting 2021-12-11; no user actions necessary
For Comfy and Enlighted, see also chapter Additional Information below
|
All versions >= V10.2 |
Remove the JndiLookup class from the classpath.
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
|
All versions |
Remove the JndiLookup class from the classpath.
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601468
|
All versions >= V8.6.2j.398 < V8.6.2.472 |
Update to V8.6.2.472 or later version
|
All versions |
HEEDS Connect team will contact all impacted customers to deploy a new log4j version. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge-base/PL8601661
|
All versions |
Specific fix versions based on V6.0.2 and V6.0.3 were released and deployed for all affected projects
|
All versions < 2021-12-13 |
Vulnerabilities fixed on central cloud service starting 2021-12-13; no user actions necessary
|
All versions < V1.4.11 |
Update to V1.4.11 or later version
|
All versions < V1.4.0-42 |
Update to V1.4.0-42 or later version
|
V4.70 SP9 |
Update to V4.70 SP9 Security Patch 1 or later version. Please contact your local Siemens representative. |
V21Q4 |
Apply the patch. Please contact your local Siemens representative.
|
All versions |
Although the Mendix runtime itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. This advice is regardless of the JRE/JDK version the app runs on.
|
All versions < 2021-12-16 |
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
|
All versions < 2021-12-16 |
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
|
All versions < 2021-12-14 |
Although the Cloud Foundry environment itself is not vulnerable to this exploit, we nevertheless recommend to upgrade log4j-core to the latest available version if log4j-core is part of your project. https://support.sw.siemens.com/en-US/product/268530510/knowledge-base/PL8600797 |
All versions < 2021-12-11 |
Vulnerabilities fixed on central cloud service starting 2021-12-11; no user actions necessary
|
All versions < 2021-12-16 |
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
|
All versions < 2021-12-16 |
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
|
All versions < 2021-12-16 |
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
|
All versions < 2021-12-23 |
Vulnerabilities fixed with update on 2021-12-23; no user actions necessary
|
All versions < 2021-12-16 |
Vulnerabilities fixed with update on 2021-12-16; no user actions necessary
|
All versions < 2021-12-21 |
Vulnerabilities fixed with update on 2021-12-21; no user actions necessary
|
All versions < V1973.4340 |
Update to V1973.4340 or later version
|
All versions < V2000.3400 |
Update to V2000.3400 or later version
|
All versions < V2008 |
Update to V2008 or later version
|
All versions < 2021-12-19 |
Vulnerabilities fixed on central cloud service starting 2021-12-19; no user actions necessary
|
All versions >= V17.2.3 < V18.1 |
Update to V18.1 or later version to fix CVE-2021-44228
|
All versions >= V17.2.3 < V18.1 |
Update to V18.1 or later version to fix CVE-2021-44228
|
All versions >= V3.2 < V3.5 only OEM version that ships Tableau |
Update to V3.5 or later version
|
All versions >= V1.1.3 |
Update the UAA component to V75.8.3
|
V4.1, V4.2 |
Remove the JndiLookup class from the classpath. Detailed instructions are available at https://support.industry.siemens.com/cs/ww/en/view/109805602/
|
All versions >= 4.2 < 4.4.1 |
Update to V4.4.1 or later version
|
All versions with affected Adaptec RAID |
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
Stop and disable autostart for maxView Storage Manager WebServer. Note: This software is not required for the underlying RAID to work
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
|
All versions with affected Adaptec RAID |
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/
Stop and disable autostart for maxView Storage Manager WebServer. Note: This software is not required for the underlying RAID to work
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
|
All versions with affected Adaptec RAID |
Follow the remediation steps documented at https://ask.adaptec.com/app/answers/detail/a_id/17527/
Stop and disable autostart for maxView Storage Manager WebServer. Note: This software is not required for the underlying RAID to work
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
|
All versions with affected Adaptec RAID |
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/
Stop and disable autostart for maxView Storage Manager WebServer. Note: This software is not required for the underlying RAID to work
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
|
All versions with affected Adaptec RAID |
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/
Stop and disable autostart for maxView Storage Manager WebServer. Note: This software is not required for the underlying RAID to work
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
|
All versions with affected Adaptec RAID |
Update the driver for the SmartRAID controller to V2.6.6 or later version, available at https://storage.microsemi.com/en-us/support/raid/sas_raid/asr-3151-4i/
Stop and disable autostart for maxView Storage Manager WebServer. Note: This software is not required for the underlying RAID to work
Disable ports 8080/tcp and 8443/tcp in the firewall configuration of the IPC
|
All versions < 2022.1-2008 |
Update to 2022.1-2008 or later version
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8601203
|
All versions only if Teamcenter integration feature is used |
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en-US/knowledge-base/PL8600700
|
All versions only if Teamcenter integration feature is used |
Update Teamcenter to any fix version available for the different version lines of Teamcenter, see https://support.sw.siemens.com/en-US/knowledge-base/PL8600700
|
All versions < V2021.2.2 |
Update to V2021.2.2 or later version
Find detailed mitigation steps for both server and client installations at: https://support.sw.siemens.com/en-US/knowledge-base/PL8602538
|
All versions >= 2021.1 |
Follow the remediation steps documented at: https://support.sw.siemens.com/en-US/knowledge-base/PL8602466
|
All versions |
Simcenter Testlab Data Management team will contact all impacted customer to deploy the mitigation measures. This action will secure your installation against Log4Shell vulnerability. For further information see: https://support.sw.siemens.com/en-US/knowledge-base/PL8601418
|
All versions |
Apply the patch
|
All versions < V2.85.7.5 |
Update to V2.85.7.5 or later version
|
All versions >= V4.16.2.1 |
Vulnerabilities fixed for Command installations on a project basis; no user actions necessary
|
All versions |
A hotfix is available; please contact customer support to receive the hotfix
|
All versions < V2.2.7 |
Update to V2.2.7 or later version; please contact customer support to receive the latest version
|
All versions < V2.3.2 |
Update to V2.3.2 or later version; please contact customer support to receive the latest version
|
All versions |
Update to V1.5 SP4 and apply the patch
|
All versions |
Update to V1.6 SP1 and apply the patch
|
All versions |
Vulnerabilities fixed for Vantage installations on a project basis; no user actions necessary
|
All versions < V2008 |
Update to V2008 or later version
|
All versions >= V2020 SP2002 < V2022 SP2202 only if Teamcenter integration feature is used |
Update to V2022 SP2202 or later version
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions >= V4.70 SP8 < V4.70 SP9 Security Patch 1 |
Update to V4.70 SP9 and apply Security Patch 1. Please contact your local Siemens representative.
|
All versions >= V2.30 SP2 |
Update to V21Q4 and apply the patch. Please contact your local Siemens representative.
|
All versions < V4.3.13 |
Update to V4.3.13 or later version
|
All versions < V5.0.11 |
Update to V5.0.11 or later version
|
All versions < V5.1.8 |
Update to V5.1.8 or later version
|
All versions < V5.2.6 |
Update to V5.2.6 or later version
|
All versions < V4.0.3 |
Update to V4.0.3 or later version
|
All versions < V4.1.1.1 |
Update to V4.1.1.1 or later version
|
All versions < V4.2.0.2 |
Update to V4.2.0.2 or later version
|
All versions < V5.1.5 |
Update to V5.1.5 or later version
|
All versions < V5.2.3 |
Update to V5.2.3 or later version
|
All versions < 13.0.1.2 |
Update to V13.0.1.2 or later version
|
All versions <= V3.3.0.7 |
Update to V3.3.0.7 or later version
|
All versions <= V4.0.0.2 |
Update to V4.0.0.2 or later version
|
All versions <= V13.0.0.2 |
Update to V13.0.0.2 or later version
|
All versions <= V13.1.0.1 |
Update to V13.1.0.1 or later version
|
All versions <= V13.2.0.1 |
Update to V13.2.0.1 or later version
|
All versions < V4.1.2 |
Update to V4.1.2 or later version
|
All versions < V4.2.3 |
Update to V4.2.3 or later version
|
All versions < V4.3.3 |
Update to V4.3.3 or later version
|
All versions < V5.0.6 |
Update to V5.0.6 or later version
|
All versions < V5.1.5 |
Update to V5.1.5 or later version
|
All versions < V5.2.4 |
Update to V5.2.4 or later version
|
All versions < V5.1.8 |
Update to V5.1.8 or later version
|
All versions < V5.2.6 |
Update to V5.2.6 or later version
|
All versions >= V11.3 |
Remove the JndiLookup class from the classpath.
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/en-US/knowledge-base/PL8600700
|
All versions < V12.2.8 |
Update to V12.2.8 or later version
|
All versions < V12.3.11 |
Update to V12.3.11 or later version
|
All versions < V12.4.1 |
Update to V12.4.1 or later version
|
All versions < V13.2.1.1 |
Update to V13.2.1.1 or V13.3.0.0 or later version
|
All versions >= V2.10 < V13.0.1 |
Update to V13.0.1 or later version
|
All versions < V12.1.0.14 |
Update to V12.1.0.14 or later version
|
All versions < 12.2.0.18 |
Update to V12.2.0.18 or later version
|
All versions < V12.3.0.15 |
Update to V12.3.0.15 or later version
|
All versions < V12.4.0.12 |
Update to V12.4.0.12 or later version
|
All versions < V13.0.0.9 |
Update to V13.0.0.9 or later version
|
All versions < V13.1.0.8 |
Update to V13.1.0.8 or later version
|
All versions < V13.2.0.6 |
Update to V13.2.0.6 or later version
|
All versions < V13.3.0.1 |
Update to V13.3.0.1 or later version
|
V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2 |
Apply the hotfix
|
All versions |
Vulnerabilities fixed on central cloud service; no user actions necessary
|
V15.0, V16.0, V16.1 only if TCCS is installed |
Download and install the updated TCCS setup from the Siemens Support Center; for details see https://support.sw.siemens.com/knowledge-base/PL8615527
|
All versions >= V14.1 |
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
|
All versions >= V14.1 |
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
|
All versions >= V14.1 |
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
|
All versions >= V14.1 |
Apply the hotfix, available for versions V14.1, V15.0, V15.1, V15.1.2, V16.0, V16.0.1, V16.0.2, V16.1, V16.1.1, V16.1.2
|
V6.0, V6.1 |
Vulnerabilities fixed on remote VPL server; no user actions necessary
|
V6.0, V6.1 |
Remove the JndiLookup class from the classpath.
Find detailed remediation and mitigation information at: https://support.sw.siemens.com/knowledge-base/MG618362
|
All versions >= 2019.1 SP1912 only if Teamcenter integration feature is used |
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions < V2020.1 SP2202 only if Teamcenter integration feature is used |
Update to V2020.1 SP2202 or later version
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions < V2021.1 SP2202 only if Teamcenter integration feature is used |
Update to V2021.1 SP2202 or later version
Find detailed mitigation steps at: https://support.sw.siemens.com/en-US/knowledge-base/MG618363
|
All versions < VX.2.10 Update 4 |
Update to VX.2.10 Update 4 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions |
Apply the hotfix
|
All versions < VX.2.7 Update 19 |
Update to VX.2.7 Update 19 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions < VX.2.8 Update 13 |
Update to VX.2.8 Update 13 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions < VX.2.10 Update 4 |
Update to VX.2.10 Update 4 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions < VX.2.10 Update 4 |
Update to VX.2.10 Update 4 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions |
Apply the hotfix
|
All versions < VX.2.7 Update 19 |
Update to VX.2.7 Update 19 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions < VX.2.8 Update 13 |
Update to VX.2.8 Update 13 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
All versions < VX.2.10 Update 4 |
Update to VX.2.10 Update 4 or later version
Additional information is available at https://support.sw.siemens.com/en-US/product/1644094854/knowledge-base/MG618343
|
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
The vulnerability classification has been performed by using the CVSS scoring system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS environmental score is specific to the customer’s environment and will impact the overall CVSS score. The environmental score should therefore be individually defined by the customer to accomplish final scoring.
An additional classification has been performed using the CWE classification, a community-developed list of common software security weaknesses. This serves as a common language and as a baseline for weakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found at: https://cwe.mitre.org/.
Apache Log4j V2, versions < 2.15.0 do not protect JNDI features (as used in configuration, log messages, and parameters) against attacker controlled LDAP and other JNDI related endpoints.
An attacker who can control log messages or log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
CVSS v3.1 Base Score | 10.0 |
CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
The fix to address CVE-2021-44228 was incomplete in certain non-default configurations, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, ${ctx:loginId}).
This could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments.
CVSS v3.1 Base Score | 9.0 |
CVSS Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C |
CWE | CWE-20: Improper Input Validation |
This advisory will be updated as more information becomes available.
Non-exhaustive List of Products Currently Considered As Not Affected:
In particular, the following Siemens products are currently considered as not affected:
As mentioned above, this is an ongoing investigation. Thus, products that are currently considered as not affected may subsequently be considered as affected when additional information becomes available.
Errata:
The following products were temporarily listed as affected. They were removed after closer investigation showed that they are not affected:
Additional Notes:
For the impact of the Log4j vulnerabilities to solutions provided by Siemens Mobility and Affiliates please address your local service or sales contact.
Note: two additional vulnerabilities were published for Apache Log4j, the impact of which are documented in SSA-501673: https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf (CVE-2021-45105) and SSA-784507: https://cert-portal.siemens.com/productcert/pdf/ssa-784507.pdf (CVE-2021-44832).
For more details regarding the Log4j vulnerabilities refer to https://logging.apache.org/log4j/2.x/security.html
V1.0 (2021-12-13): | Publication Date |
V1.1 (2021-12-15): | Added additional (potentially) affected products and additional remediation or mitigation measures; added reference to CVE-2021-45046 and updated mitigations accordingly |
V1.2 (2021-12-16): | Added additional affected products, remediation or mitigation measures, and products under investigation; removed SIMATIC WinCC V7.4 because it is not affected |
V1.3 (2021-12-17): | Added additional affected products, remediation or mitigation measures, and products under investigation; removed LOGO! Soft Comfort because it is not affected; expanded Teamcenter Suite to individual affected applications in Teamcenter; updated information for Desigo CC and Cerberus DMS |
V1.4 (2021-12-18): | Revised severity of CVE-2021-45046 and removed ineffective mitigation measures; added Comfy and Enlighted; added individual Mindsphere applications; removed Siveillance Viewpoint because it is not affected; added a statement regarding Siemens Mobility solutions |
V1.5 (2021-12-19): | Added reference to new SSA-501673 that covers a new Log4j vulnerability (CVE-2021-45105); added remediation for SENTRON powermanager V4; added Connect X200/X300 gateways |
V1.6 (2021-12-20): | Added non-exhaustive list of Siemens products currently not considered as affected; updated information for Industrial Edge Management OS and for SENTRON powermanager; updated impact, mitigation measures and fix release information for EnergyIP Prepay; added remediation for SIGUARD DSA; clarified Building Operator Discovery Applications vs. Connect X200/X300 gateways; added remediation for Advantage Navigator Software Proxy V6; added Advantage Navigator Software Proxy V5 to list of not affected products |
V1.7 (2021-12-21): | Added solution for MindSphere Visual Explorer; added jROS for Spectrum Power, Building Twin - 360° Viewer, and NXpower Monitor; added additional products considered as not affected |
V1.8 (2021-12-22): | Added Simcenter Testlab and Teamcenter Integration for CATIA; added additional products considered as not affected |
V1.9 (2021-12-23): | Added solution for MindSphere Predictive Learning, GMA-Manager, Operation Scheduler, and Siveillance Identity; added SIMATIC IT Report Manager, Simcenter System Simulation Client for Git, Tecnomatix Intosite, Tecnomatix Plant Simulation, and Valor Parts Library; added additional products considered as not affected; updated section "Workarounds and Mitigations" |
V2.0 (2021-12-27): | Added solution for Xpedition Enterprise and IC Packaging; updated information for Geolus Shape Search; added SIMATIC IPCs as under investigation; added additional products considered as not affected |
V2.1 (2021-12-28): | Added SIMATIC IPCs with Adaptec RAID; added additional Tecnomatix products (Process Designer, Process Simulate, RobotExpert, eBOP Manager Server); added reference to new SSA-784507 that covers a new Log4j vulnerability (CVE-2021-44832) |
V2.2 (2022-01-05): | Added solution for Simcenter 3D, and for Tecnomatix eBOP Manager Server V15.0, V16.0.2; added cRSP Operator Client Starter as under investigation; added a note regarding Enlighted Manage |
V2.3 (2022-01-17): | Added solution for SiPass integrated, for Industrial Edge Management OS and App, and for Tecnomatix eBOP Manager Server V16.0.1, V16.1.1, V16.1.2; clarified the impact to cRSP and cRSP Operator Client Starter; added additional products considered as not affected |
V2.4 (2022-01-28): | Added solutions for Teamcenter Active Workspace (AW), Microservices Framework (MSF) and Reporting and Analytics (TcRA); removed Teamcenter Requirements Integrator because it is not affected; added additional products considered as not affected |
V2.5 (2022-02-08): | Added solution for Spectrum Power 4 and 7 (incl. jROS), for Teamcenter Technical Publishing and for Xpedition Enterprise and IC Packaging, versions VX.2.7, VX.2.8, VX.2.10; added additional products considered as not affected |
V2.6 (2022-03-08): | Added or updated solutions for Siveillance Command, Control Pro, Vantage; added solution for Tecnomatix Plant Simulation (installations with TCCS) |
V2.7 (2022-04-12): | Added solution for NX; confirmed that SIMATIC IT Report Manager is not affected; removed section "Products Under Investigation" |
V2.8 (2022-05-10): | Added solution for Capital, COMOS, HES UDIS, Simcenter System Simulation Client for Git, Solid Edge CAM Pro, Solid Edge Wiring and Harness Design, VeSys; updated solution for SIMATIC IPC and SiPass V2.85; EnergyIP Prepay: clarified that fix release V3.8.0.12 is also valid for versions before V3.8 |
V2.9 (2022-06-14): | Added fix for Opcenter Intelligence, Simcenter Amesim and Simcenter System Architect and for all affected version lines of Teamcenter product suite |
V3.0 (2022-08-09): | Updated fix information for COMOS and Desigo CC V5.1 |