-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-538778: SmartVNC Vulnerabilities in SIMATIC HMI/WinCC Products

Publication Date:        2021-05-11
Last Update:             2021-10-12
Current Version:         1.2
CVSS v3.1 Base Score:    9.8

SUMMARY
=======

Multiple SmartVNC vulnerabilities in the affected products listed below
could allow remote code execution and Denial-of-Service attacks under
certain conditions.

Siemens has released updates for the affected products and recommends to
update to the latest version.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V15.1 Update 6
  - Remediation:
       Update SIMATIC WinCC (TIA Portal) to V15.1 Update 6, and then update
       panel to V15.1 Update 6
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763890/

* SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V16 Update 4
  - Remediation:
       Update SIMATIC WinCC (TIA Portal) to V16 Update 4 or later version, and
       then update panel to V16 Update 4 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109775861/

* SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V15.1 Update 6
  - Remediation:
       Update SIMATIC WinCC (TIA Portal) to V15.1 Update 6, and then update
       panel to V15.1 Update 6
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763890/

* SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V16 Update 4
  - Remediation:
       Update SIMATIC WinCC (TIA Portal) to V16 Update 4 or later version, and
       then update panel to V16 Update 4 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109775861/

* SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and
KTP900F 
  - Affected versions:
       All versions < V15.1 Update 6
  - Remediation:
       Update SIMATIC WinCC (TIA Portal) to V15.1 Update 6, and then update
       panel to V15.1 Update 6
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763890/

* SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and
KTP900F 
  - Affected versions:
       All versions < V16 Update 4
  - Remediation:
       Update SIMATIC WinCC (TIA Portal) to V16 Update 4 or later version, and
       then update panel to V16 Update 4 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109775861/

* SIMATIC WinCC Runtime Advanced V15 
  - Affected versions:
       All versions < V15.1 Update 6
  - Remediation:
       Update to V15.1 Update 6
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763890/

* SIMATIC WinCC Runtime Advanced V16 
  - Affected versions:
       All versions < V16 Update 4
  - Remediation:
       Update to V16 Update 4 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109776018/


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* Restrict access to port 5900/tcp to trusted IP addresses only



GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

SIMATIC HMI Panels are used for operator control and monitoring of
machines and plants.

SIMATIC WinCC Runtime Advanced is a visualization runtime platform used
for operator control and monitoring of machines and plants.

SIPLUS extreme products are designed for reliable operation under
extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS,
SIMOTION, SCALANCE or other devices. SIPLUS devices use the same
firmware as the product they are based on.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2021-25660

  SmartVNC has an out-of-bounds memory access vulnerability that could be
  triggered on the server side when sending data from the client, which
  could result in a Denial-of-Service condition.

  CVSS v3.1 Base Score: 5.4
  CVSS Vector:          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-788: Access of Memory Location After End of Buffer

* Vulnerability CVE-2021-25661

  SmartVNC has an out-of-bounds memory access vulnerability that could be
  triggered on the client side when sending data from the server, which
  could result in a Denial-of-Service condition.

  CVSS v3.1 Base Score: 5.9
  CVSS Vector:          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-788: Access of Memory Location After End of Buffer

* Vulnerability CVE-2021-25662

  SmartVNC client fails to handle an exception properly if the program
  execution process is modified after sending a packet from the server,
  which could result in a Denial-of-Service condition.

  CVSS v3.1 Base Score: 5.9
  CVSS Vector:          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-755: Improper Handling of Exceptional Conditions

* Vulnerability CVE-2021-27383

  SmartVNC has a heap allocation leak vulnerability in the server Tight
  encoder, which could result in a Denial-of-Service condition.

  CVSS v3.1 Base Score: 7.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-770: Allocation of Resources Without Limits or Throttling

* Vulnerability CVE-2021-27384

  SmartVNC has an out-of-bounds memory access vulnerability in the device
  layout handler, represented by a binary data stream on client side,
  which can potentially result in code execution.

  CVSS v3.1 Base Score: 9.8
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-788: Access of Memory Location After End of Buffer

* Vulnerability CVE-2021-27385

  A remote attacker could send specially crafted packets to SmartVNC
  device layout handler on client side, which could influence the amount
  of resources consumed and result in a Denial-of-Service (infinite loop)
  condition.

  CVSS v3.1 Base Score: 7.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-400: Uncontrolled Resource Consumption

* Vulnerability CVE-2021-27386

  SmartVNC has a heap allocation leak vulnerability in the device layout
  handler on client side, which could result in a Denial-of-Service
  condition.

  CVSS v3.1 Base Score: 7.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-401: Missing Release of Memory after Effective Lifetime




ADDITIONAL INFORMATION
======================
- - V15.1 Update 6 solution was added to support users that can´t update
to V16 Update 4

For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2021-05-11): Publication Date
V1.1 (2021-09-14): Added additional solution for all products
V1.2 (2021-10-12): V15 sub-version numbering correction

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEHyx/myPwjH9jB9tDlm7gTEmyujQFAmFk0AAACgkQlm7gTEmy
ujTqNRAAish7d+rh+6WO3JtlvnVw2JGQB09afoHCNQJIJ9A1a93nUwQhNaAgMnl3
raz+aFO2Ru6nrwajm/6AfTyQbh8wsWE6AfMmcQOFoFVh/MwGyz6BNI+GKp7Ecoqx
D4Fi5o5Bp+prbgpUzxUoHNj8ryTLDC0ObViYiZjLQM2RmtCWAw3euvlr2UZJAWn/
5bN40WNJqMtLPCLN8HQNPNJ5O9Rqv3xjXPbnqBnq7oXkBlK7GOtcpqGBn6d2YXs9
ccnS68ulu4OXwsR0UzRQxJSoo5ymT5GfPNZEurM8v2MTvgTk1QyLSIjuKLxKF8ux
t3AWa9IJWFVnOzSlRafTjjaWBqtL1YTKua+Zo+eBtk4580PMkpwq7ZKI6cgcMmGH
QezY54LJliE/dppOJdSk08h0CIw7u6qhT6ij5SvBoczq5qo/atWcFgtdlcKmpIX+
NRMWz7+FGc/ykytNJpDzPhEbgLt5j5ky4LIkcIuS8dYuF574HHbTAXzSdm6rPVK+
bDPJ/QvbZkiWy4Ii6ZQ2DQ9+uO5cac3HtrpqnA5F2qmjU73yG05X8vWe4Zw7W8Zs
8dDFFPpwfYAM9bTYB4YTPrTs9JTy+eBLiY0tGxvlAspeeLluJaaty4MeCwR7NSQt
YiSlDOX2z3gRT4h1aYuOpdDLwuCesu/L2gOpTZUkxEc4IU47DsQ=
=TWb0
-----END PGP SIGNATURE-----