SSA-756638: Vulnerabilities in Third-Party Component Mbed TLS of LOGO! CMR Family and SIMATIC RTU 3000 Family
Publication Date:
2021-09-14
Last Update:
2022-05-10
Current Version:
V1.1
CVSS v3.1 Base Score:
7.5
SUMMARY
Devices of the LOGO! CMR family and the SIMATIC RTU 3000 family are affected by several vulnerabilities in the third party component Mbed TLS. They could allow an attacker with access to any of the interfaces of an affected device to impact the availability or to communicate with invalid certificates.
Siemens has released updates for the affected products and recommends to update to the latest versions.
AFFECTED PRODUCTS AND SOLUTION
WORKAROUNDS AND MITIGATIONS
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:
For CVE-2020-36478: Use the certificate projection feature to pin the valid certificates of external servers providing services to the RTU/CMR devices. See the manual for further information
Product specific remediations or mitigations can be found in the section Affected Products and Solution .General Security Recommendations .
GENERAL SECURITY RECOMMENDATIONS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens’ operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security ), and to follow the recommendations in the product manuals.
Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
PRODUCT DESCRIPTION
The devices of the LOGO! CMR family (in combination with the LOGO! logic module) are cost-efficient communication systems suitable for monitoring and controlling distributed plants and systems via text message or email. LOGO! CMR devices can send text messages or emails to predefined mobile network numbers as well as receive text messages from predefined mobile network numbers. The LOGO! CMR devices offer comfortable Web Based Management commissioning and diagnostics via local and/or remote access.
The devices of the RTU3000C family are compact telecontrol stations for applications with their own power supply for autonomous energy systems. They are particularly suited for monitoring and control of external stations that are not connected to an energy supply network. The RTUs can autonomously record data with time stamp from connected sensors, pre-process this data and transfer it to a control center.
VULNERABILITY CLASSIFICATION
The vulnerability classification has been performed by using the CVSS scoring system in version 3.1
(CVSS v3.1) (https://www.first.org/cvss ). The CVSS environmental score is specific to the customer’s
environment and will impact the overall CVSS score. The environmental score should therefore be
individually defined by the customer to accomplish final scoring.
An additional classification has been performed using the CWE classification, a community-developed
list of common software security weaknesses. This serves as a common language and as a baseline for
weakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found
at: https://cwe.mitre.org/ .
Vulnerability CVE-2020-36475
The calculations performed in the third-party component Mbed TLS are not limited; thus, supplying overly large parameters could lead to denial of service when generating Diffie-Hellman key pairs.
Vulnerability CVE-2020-36478
For the third-party component Mbed TLS a NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.
HISTORY DATA
V1.0 (2021-09-14): Publication Date
V1.1 (2022-05-10): Added solution for devices of SIMATIC RTU 3000 family
TERMS OF USE
Siemens Security Advisories are subject to the terms and conditions contained in Siemens’ underlying
license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License
Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens’
Global Website
https://new.siemens.com/terms_of_use ,
hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply
additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.