Siemens will stop updating ICS security advisories for product vulnerabilities as of January 10, 2023. For the most up-to-date information on vulnerabilities in this advisory, refer to the Siemens Product Security Advisory Services (CERT Services | Services | Siemens Global).
CVSS v4 9.1
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: SIDIS Prime
Vulnerabilities: Race Condition Enabling Link Following, Unvalidated Integrity Values, Unchecked Input for Loop Condition, Violation of Expected Behavior, Incorrect Provision of Specified Functionality, Heap-based Buffer Overflow, Cleartext Transmission of Sensitive Information, Use After Free, NULL Pointer Dereference, Exposure of Sensitive Information to an Unauthorized Actor, Out-of-bounds Write, Incorrect Input Validation, Uncontrolled Resource Consumption
Successful exploitation of these vulnerabilities could allow an attacker to perform unauthorized deletions, cause denial of service, corrupt application state, leak sensitive information, or potentially execute remote code.
Siemens reports that the following products are affected:
SIDIS Prime: All versions prior to V4.0.700
Siemens has released a new version of SIDIS Prime and recommends updating to the latest version:
SIDIS Prime: Update to V4.0.700 or later version
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' industrial security operational guidelines and following the recommendations in the product manuals.
For more information, see the associated Siemens security advisory SSA-277137 at HTML and CSAF.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:
- Minimize network exposure for all control system devices and/or systems, ensuring that they are not accessible from the Internet.
- Locate control system networks and remote devices behind firewalls and isolate them from business networks.
- When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.
CISA reminds organizations to perform proper impact analysis and risk assessment before implementing defensive measures.
CISA also provides a section of control systems security recommended practices on the ICS page at cisa.gov. Several CISA products detailing best practices for cyber defense are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Additional mitigation guidance and recommended practices are publicly available on the ICS page at cisa.gov in the technical paper, ICS-TIP-12-146-01B--Strategies for Detection and Mitigation of Targeted Cyber Intrusions.
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation with other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
- Do not click on web links or open attachments in unsolicited email messages.
- Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.
- Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.
No known public exploitation specifically targeting these vulnerabilities has been reported at this time.
