-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-542525: Authentication Vulnerabilities in SIMATIC HMI Products

Publication Date:        2020-09-08
Last Update:             2021-06-08
Current Version:         1.3
CVSS v3.1 Base Score:    6.5

SUMMARY
=======

SIMATIC HMI Products are affected by two vulnerabilities that could
allow a remote attacker to discover user passwords and obtain access to
the Sm@rt Server via a brute-force attack.

Siemens has released updates for the affected products and recommends to
update to the latest versions. Siemens also suggests following the
listed mitigations for the Unified Comfort Panels.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V16
  - Affected by vulnerabilities:
    - CVE-2020-15786
  - Remediation:
       Update to V16 Update 3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109775861

* SIMATIC HMI Comfort Panels (incl. SIPLUS variants) 
  - Affected versions:
       All versions <= V16
  - Affected by vulnerabilities:
    - CVE-2020-15786
  - Remediation:
       Update to V16 Update 3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109775861

* SIMATIC HMI Mobile Panels 
  - Affected versions:
       All versions <= V16
  - Affected by vulnerabilities:
    - CVE-2020-15786
  - Remediation:
       Update to V16 Update 3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109775861

* SIMATIC HMI Unified Comfort Panels 
  - Affected versions:
       All versions <= V16
  - Remediation:
       Update to V16 Update 5
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109746530


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* Apply Defense-in-Depth:
https://www.siemens.com/cert/operational-guidelines-industrial-security

* For Unified Comfort Panels using SmartClient: The password truncation
(CVE-2020-15787) cannot be resolved due to RFC 6143 and is limited to 8
characters. It is recommended to use complex passwords



GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

SIMATIC HMI Panels are used for operator control and monitoring of
machines and plants.

SIPLUS extreme products are designed for reliable operation under
extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS,
SIMOTION, SCALANCE or other devices. SIPLUS devices use the same
firmware as the product they are based on.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2020-15786

  Affected devices insufficiently block excessive authentication attempts.
  
  This could allow a remote attacker to discover user passwords and obtain
  access to the Sm@rt Server via a brute-force attack.

  CVSS v3.1 Base Score: 6.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C
  CWE:                  CWE-307: Improper Restriction of Excessive Authentication Attempts

* Vulnerability CVE-2020-15787

  Affected devices insufficiently validate authentication attempts as the
  information given can be truncated to match only a set number of
  characters versus the whole provided string.
  
  This could allow a remote attacker to discover user passwords and obtain
  access to the Sm@rt Server via a brute-force attack.

  CVSS v3.1 Base Score: 5.3
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C
  CWE:                  CWE-305: Authentication Bypass by Primary Weakness


ACKNOWLEDGMENTS
===============

Siemens thanks the following parties for their efforts:

   * Joseph Gardiner from Bristol Cyber Security Group - University of Bristol for reporting the vulnerabilities



ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2020-09-08): Publication Date
V1.1 (2020-10-13): Added mitigations and fix dates
V1.2 (2020-12-08): Added patch links for SIMATIC HMI Basic (2nd generation), Comfort
(including SIPLUS variants) and Mobile Panels
V1.3 (2021-06-08): Added patch link for Unified Comfort Panel, and mitigation for
components that will not be remediated due to limitations.

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElTRCLAVwzKf/b8X80/SB6hFKr+QFAmC+swAACgkQ0/SB6hFK
r+RNCBAAreu5NpGiPYBXrLqv+Urcg1MNGY/NVfMlHPMNlOA7H6NSRXqa+8kLnmeN
1SIVrl12JwL/robXM1YCR94Yufs7Hq1ShgSZKTetEDGDTa8mAHUNzdgJTRzdOApq
+hFJ3p5iPrHdPPEl4/EgjyJ4MzZe+UzHlVd9oflULqQhPmJwcHFq4DxipGwUHP65
yfOaFwYfsNS6bKMEoU0AzEZNky2l/mfxJidiUh/KaQCESPwgRNOpqwDQl/KbJhP6
lLj2W6JgdZZWe3rnDlHJfoDrK9UBTkKpvsMZwxPlSO1CxTdEk6HhnIvlLNdHds51
bG4Q4CYaiJEgaHHRGE/ZXwvtra85U3CP/MWmr2Jrm/VJTO+CzRs9UwrOHSSd3RtX
YeBs6GuGQlsSxD7HJU1k9ni9nqoyQkpLT/Eq29sDcT1lmF8a6FIPErqpvseBcssi
jvbR5ePtfe4l7wEL9CIINB/zQfLsbSSgRqnlWIZYHmKtrM3PyoFvFIRuoZ/Qgcmx
3Jnmuk3RW0gxKwHIftiScpNL3u2mNFh/tGs8YrjgNuPsH52aACNCi4rBqXxdRZ3V
ITW0LTeDPoWMZVUjm7NHcDRQrgowLPk7fhbKMYouXHDW4EqpMWZPy+kNeMkOUhG3
uRpLaZQ97CrdZf0lblFgAIy2fSKJr5YLA8mV0DkJkssYzOGzlnA=
=NWN3
-----END PGP SIGNATURE-----