-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-780073: Denial-of-Service Vulnerability in PROFINET Devices via DCE-RPC Packets

Publication Date:        2020-02-11
Last Update:             2020-12-08
Current Version:         1.6
CVSS v3.1 Base Score:    7.5

SUMMARY
=======

Products that include the Siemens PROFINET-IO (PNIO) stack in versions
prior V06.00 are potentially affected by a denial-of-service
vulnerability when multiple legitimate diagnostic package requests are
sent to the DCE-RPC interface.

Siemens has released updates for several affected products and
recommends to update to the new versions. Siemens is preparing further
updates and recommends specific countermeasures for products where
updates are not, or not yet available.

Additionally, Siemens recommends other vendors of PROFINET devices to
check if their products have incorporated a vulnerable version of the
Siemens PNIO stack as part of the Siemens Development/Evaluation Kits.


AFFECTED PRODUCTS AND SOLUTION
==============================


* Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet
Controller 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 
  - Affected versions:
       All Versions < V4.5
  - Remediation:
       Update to V4.5 Patch 01
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109760397/

* Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P 
  - Affected versions:
       All Versions < V4.6
  - Remediation:
       Update to V4.6
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109765183/

* PROFINET Driver for Controller 
  - Affected versions:
       All Versions < V2.1
  - Remediation:
       Update to V2.1 Patch 03
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109768047/

* RUGGEDCOM RM1224 
  - Affected versions:
       All versions < V4.3
  - Remediation:
       See SCALANCE M-800 / S615

* SCALANCE M-800 / S615 
  - Affected versions:
       All versions < V4.3
  - Remediation:
       Update to V6.1.2
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109772130/

* SCALANCE W700 IEEE 802.11n 
  - Affected versions:
       All versions <= V6.0.1
  - Remediation:
       Update to V6.4
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109773308/

* SCALANCE X-200 switch family (incl. SIPLUS NET variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) 
  - Affected versions:
       All Versions < V5.3
  - Remediation:
       Update to V5.4.2
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109763309/

* SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SCALANCE XB-200, XC-200, XP-200, XF-200BA and XR-300WG 
  - Affected versions:
       All Versions < V3.0
  - Remediation:
       Update to V4.1
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109762982/

* SCALANCE XM-400 switch family 
  - Affected versions:
       All Versions < V6.0
  - Remediation:
       Update to V6.2.3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109771191/

* SCALANCE XR-500 switch family 
  - Affected versions:
       All Versions < V6.0
  - Remediation:
       Update to V6.2.3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109771193/

* SIMATIC ET200AL IM 157-1 PN 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200M IM153-4 PN IO HF (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200M IM153-4 PN IO ST (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200MP IM155-5 PN HF (incl. SIPLUS variants) 
  - Affected versions:
       All Versions < V4.2.0
  - Remediation:
       Update to V4.2.0
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/93012181/

* SIMATIC ET200MP IM155-5 PN ST (incl. SIPLUS variants) 
  - Affected versions:
       All Versions < V4.1.0
  - Remediation:
       Update to V4.1.0
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/78647504/

* SIMATIC ET200S (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200SP IM155-6 PN Basic (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200SP IM155-6 PN HF (incl. SIPLUS variants) 
  - Affected versions:
       All Versions < V3.3.1
  - Remediation:
       Update to V4.2.2
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/85624387/

* SIMATIC ET200SP IM155-6 PN ST (incl. SIPLUS variants) 
  - Affected versions:
       All Versions < V4.1.0
  - Remediation:
       Update to V4.1.0
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/78648144/

* SIMATIC ET200ecoPN (except 6ES7141-6BG00-0BB0, 6ES7141-6BH00-0BB0,
6ES7142-6BG00-0BB0, 6ES7142-6BR00-0BB0, 6ES7143-6BH00-0BB0,
6ES7146-6FF00-0AB0 and 6ES7148-6JD00-0AB0) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200pro, IM 154-3 PN HF 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC ET200pro, IM 154-4 PN HF 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC IPC Support, Package for VxWorks 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC MV400 family 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 1616 and CP 1604 
  - Affected versions:
       All Versions < V2.8
  - Remediation:
       Update to V2.8.1
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109768663/

* SIMATIC NET CP 343-1 (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 343-1 ERPC 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 343-1 LEAN (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 443-1 (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 443-1 Advanced (incl. SIPLUS variants) 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC NET CP 443-1 OPC UA 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC PN/PN Coupler 6ES7158-3AD01-0XA0 (incl. SIPLUS NET variant) 
  - Affected versions:
       All Versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC RF180C 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC RF182C 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations

* SIMATIC RF600 family 
  - Affected versions:
       All versions < V3
  - Remediation:
       Update to V3.2.1
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109768501

* SIMOTION C 
  - Affected versions:
       All versions < V4.5
  - Remediation:
       Update to V4.5 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/31263919

* SIMOTION D (incl. SIPLUS variants) 
  - Affected versions:
       All versions < V4.5
  - Remediation:
       Update to V4.5 or later version
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/31045047

* SIMOTION P 
  - Affected versions:
       All versions < V4.5
  - Remediation:
       Update to V4.5 or later version
  - Download:
       Please contact your Siemens representative for information on how to
       obtain the update.

* SINAMICS DCP 
  - Affected versions:
       All Versions < V1.3
  - Remediation:
       Update to V1.3
  - Download:
       https://support.industry.siemens.com/cs/ww/en/view/109773826/

* SOFTNET-IE PNIO 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workarounds and Mitigations


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* Block incoming DCE-RPC packets (port 34964/udp) from untrusted networks
  
* For SCALANCE M-800 / S615 and RUGGEDCOM RM1224: Create a firewall rule
that blocks the PROFINET Context Manager port (34964/udp)
  
* Disable PROFINET in products, where PROFINET is optional and not used in
your environment
  
* For SIMATIC RF180C and RF182C: migrate to a successor product within the
SIMATIC RF18xC/CI family, V1.3 or later version. For details refer to
the phase-out announcement.
  


GENERAL SECURITY RECOMMENDATIONS
================================

As a general security measure, Siemens strongly recommends to protect
network access to devices with appropriate mechanisms. In order to
operate the devices in a protected IT environment, Siemens recommends to
configure the environment according to Siemens' operational guidelines
for Industrial Security (Download:
https://www.siemens.com/cert/operational-guidelines-industrial-security),
and to follow the recommendations in the product manuals.

Additional information on Industrial Security by Siemens can be found
at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION
===================

The SINAMICS converter family is used to control a wide variety of
drives, especially in mechanical engineering and plant construction.

Development/Evaluation Kits for PROFINET IO are used to develop compact
or modular PROFINET field devices.

PROFINET Driver is a development kit used to develop PROFINET IO
controllers.

SCALANCE X switches are used to connect industrial components like
Programmable Logic Controllers (PLCs) or Human Machine Interfaces
(HMIs).

The SCALANCE M-800 / S615 industrial routers are used for secure remote
access to plants via mobile networks, e.g. GPRS or UMTS with the
integrated security functions of a firewall for protection against
unauthorized access and VPN to protect data transmission.

SCALANCE W products are wireless communication devices used to connect
industrial components, like Programmable Logic Controllers (PLCs) or
Human Machine Interfaces (HMIs), according to the IEEE 802.11 standard
(802.11ac, 802.11a/b/g/h, and/or 802.11n).

SIMATIC NET CP 1616 and CP 1604 are PCI/PCI-104 cards for
high-performance connection of field devices to Industrial Ethernet with
PROFINET.

Communication Processor (CP) modules of families SIMATIC NET CP 343-1
and CP 443-1 have been designed to enable SIMATIC S7-300/S7-400 CPUs for
Ethernet communication.

SIMATIC RF600 Readers are used for the contactless identification of
every kind of object, e.g. transport containers, pallets, production
goods, or it can be generally used for recording goods in bulk.

SIMATIC RF180C is an RFID communication module for direct connection of
SIMATIC identification systems to PROFINET IO/Ethernet. SIMATIC RF180C
is superseded by the SIMATIC RF18xC devices (RF185C, RF186C, RF188C).

SIMATIC RF182C is an RFID communication module for direct connection of
SIMATIC identification systems to Ethernet/IP. SIMATIC RF182C is
superseded by the SIMATIC RF18xC devices (RF185C, RF186C, RF188C).

SIMATIC RF185C, RF186C/CI, and RF188C/CI are communication modules for
direct connection of SIMATIC identification systems to PROFINET
IO/Ethernet and OPC UA.

The stationary optical readers of the SIMATIC MV400 family are used to
reliably capture printed, lasered, drilled, punched and dotpeen codes on
a variety of different surfaces.

SIMATIC ET 200 Interface modules for PROFINET IO are used to connect
field devices (IO Devices) to controllers (IO Controller) via PROFINET.

With the SIMATIC IPC Support Package for VxWorks, Siemens offers support
for industrial computers (SIMATIC IPCs) for the VxWorks real-time
operating system.

SIMOTION is a scalable high performance hardware and software system for
motion control.

PN/PN coupler is used for connecting two PROFINET networks.

The SOFTNET product family includes several software applications for
connecting programming devices to Industrial Ethernet and PROFIBUS.

SIPLUS extreme products are designed for reliable operation under
extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS,
SIMOTION, SCALANCE or other devices. SIPLUS devices use the same
firmware as the product they are based on.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS 
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be 
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2019-13946

  Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit
  internal resource allocation when multiple legitimate diagnostic package
  requests are sent to the DCE-RPC interface. This could lead to a denial
  of service condition due to lack of memory for devices that include a
  vulnerable version of the stack.
  
  The security vulnerability could be exploited by an attacker with
  network access to an affected device. Successful exploitation requires
  no system privileges and no user interaction. An attacker could use the
  vulnerability to compromise the availability of the device.

  CVSS v3.1 Base Score: 7.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
  CWE:                  CWE-400: Uncontrolled Resource Consumption


ACKNOWLEDGMENTS
===============

Siemens thanks the following parties for their efforts:

   * Yuval Ardon and Matan Dobrushin from OTORIO for coordinated disclosure
   * The Cybersecurity and Infrastructure Security Agency (CISA) for coordination efforts



ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and 
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2020-02-11): Publication Date
V1.1 (2020-03-10): Added affected product SOFTNET-IE PNIO
V1.2 (2020-03-12): Additional information in section "Workarounds and Mitigations"
V1.3 (2020-08-11): No changes - this version was never released
V1.4 (2020-08-11): Added SIMATIC ET200ecoPN product variants (MLFB IDs) that are not
affected
V1.5 (2020-09-08): Informed about successor products for SIMATIC RF180C and RF182C
V1.6 (2020-12-08): Added SIMOTION products; Updated information regarding successor
products for SIMATIC RF180C and RF182C

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElTRCLAVwzKf/b8X80/SB6hFKr+QFAl/OwgAACgkQ0/SB6hFK
r+Q9mA//YTnlvv4aeKksA/pGUHp0YW2gDUkw1mxDCmiJHlFumrlHH7CiKV2P+biZ
zj5AQFJ+/t+SK4RrMp/1uFYJo9RBOmWD3lAB+rsdb1PWMeIYqGQrU98UlV4RF+7d
U8+oOIOkcZkZligJHBsS5JhH2SWB8qPnLRMJqT5aXuGuRCftOT07JKnrWvkPtNj5
4vpJNal+ERgHPMF8/TL91i8wgFJt7yd+8SJfjSAz3bavZ88nLZfrSf/OSLUjnz1D
dQEHip7fNaFE62vPdKTXHT4abPCkHdaYIZiJyH3qprIwQMjh5ZlvYEI2dZ1sz8CE
k5/plwQGh6a5zrZMn/Gj3Z+4NPTWXF4A2nxUOihNtud+RRsjQMctdH/MzydkoTla
9K5LSkPkoUHAw1zJHj0GoxmN7jRx0h+QTJC2cVMLXiMYQxN8uALwBNuP+bLF41fu
Ocwh/hcyLgZax+CXiYobysguI3gCZjWwmVVPUb2J2cxPl61kBJ2Xt5sQ9ODDVoau
UkVAtCMBrDP7hVyEySH5LingcXdDvhSHtSnsr7IOhydC10KitTqp9vetrq01O1rx
zFQAvhPVQXKCN/gZsebwWBPIvDN2J9gzYAKzGTKtRDP3pkDxMT1RCstCg7EaO8eF
MGwkvIHolyod0akv1BYOaxI/2D6gbjNPqGnCxabmuSyS+ZtHluc=
=K9yV
-----END PGP SIGNATURE-----