-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-134003: Web Vulnerability in SIMATIC S7-1200 Family

Publication Date:        2015-08-27
Last Update:             2020-02-10
Current Version:         1.1
CVSS v3.1 Base Score:    8.8

SUMMARY
=======

The latest firmware update for SIMATIC S7-1200 CPUs fixes a
vulnerability that could allow an attacker to perform a CSRF (Cross-Site
Request Forgery) attack under certain conditions.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SIMATIC S7-1200 CPU family (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V4.1.3
  - Remediation:
       Update to V4.1.3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/ps/13685/dl


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* Apply appropriate strategies for mitigation.
  


GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

Products of the SIMATIC S7-1200 CPU family have been designed for
discrete and continuous control in industrial environments such as
manufacturing, food and beverages, and chemical industries worldwide.

SIPLUS extreme products are designed for reliable operation under
extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS,
SIMOTION, SCALANCE or other devices. SIPLUS devices use the same
firmware as the product they are based on.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS 
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be 
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2015-5698

  The integrated web server (port 80/tcp and port 443/tcp) of the affected
  PLCs could allow remote attackers to perform actions with the
  permissions of a victim user, provided the victim user has an active
  session and is induced to trigger the malicious request.

  CVSS v3.1 Base Score: 8.8
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-352: Cross-Site Request Forgery (CSRF)


ACKNOWLEDGMENTS
===============

Siemens thanks the following parties for their efforts:

   * Ralf Spenneberg, Hendrik Schwartke, and Maik Brüggemann from OpenSource Training for coordinated disclosure
   * Artem Zinenko from Kaspersky for pointing out that SIPLUS should also be mentioned



ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and 
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2015-08-27): Publication Date
V1.1 (2020-02-10): SIPLUS devices now explicitly mentioned in the list of affected products

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJeQJ0AAAoJENP0geoRSq/k7HcP/1J2UCXHMox48GKZQbXckYCF
XGXWGY5+Q4Ei0XeTH9D4Vwj2hFAUtf6fJMx/a3S3+iIfKpWVcUsGTrkWMYOdBOWW
FFLP5anPlcvExFc12acbETK1Tk6+o3gtA46oP+A31PSlnT+nsSZwhwkTzicsmCjc
PMQkuo7oTL78FdPUmSnC54IF60PxMF5Z/yhqPmtHV4MivnPxgg0mgp1qXxrCJIzB
WNPbSAY6hDtiJcetSjNLkkLH9FsMA3JNu8zv3GT/cL5KZXJS8lxouNSHZl0m0XfQ
1hWEC7j89vqj+oTKCiRo+K4lYd6b6PgXTmHvfHksgOgvaOMiZrQ1fbi5r+RkJlfk
04wygWj1LzaincFzWSo8EGb5VZ9mt8/o54CF8PsfCdgCvCr7fQLYLNnxBYbJR4CO
8wI4yMBXWI8tHScivivOVo5tHu+JDPy0Lr5PSkYDXOTtZZf5OdtDjoUTZ+RUYXwh
WJfZgEAqtDKmnsnV6MZxRucbbFFFebma+Ch2zuzut2kzPS8d2pafITww2oVrxIks
Kx39vGaZTR2vXD7+8pSRtrgJ68A409/3H7D8wr0uNLfIVwDEivqeMsbnypOuQ3tZ
H9BYj0d+eoUpeVAG/Qjy+Sk73GANbMavOO2uvXKr0r8YquTfW5yCN/hj/84lNtcZ
y+C7TrzR53Loa6WpRR6n
=CGSO
-----END PGP SIGNATURE-----