Siemens patches critical SCADA flaws likely exploited in recent attacks

The vulnerabilities allow remote attackers to extract files from WinCC SCADA servers and execute arbitrary code on them

Siemens released security updates for several of its SCADA (supervisory control and data acquisition) products for industrial environments, in order to fix critical vulnerabilities that may have been exploited in recent attacks.

One of the vulnerabilities allows unauthenticated attackers to remotely execute arbitrary code on a Siemens SIMATIC WinCC SCADA server by sending specially crafted packets to it. The flaw received the maximum severity score of 10 in the Common Vulnerability Scoring System and can lead to a full system compromise.

The other vulnerability can also be exploited by unauthenticated attackers by sending specially crafted packets, but to extract arbitrary files from the WinCC server. The flaw has a CVSS score of 7.8.

According to the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), a division of the U.S. Department of Homeland Security, it's likely that attackers are already aware of these vulnerabilities and are exploiting them.

"Exploits that target these vulnerabilities are potentially available," ICS-CERT said in a security advisory Tuesday. "Indicators exist that this vulnerability may have been exploited during a recent campaign."

ICS-CERT did not say to which campaign it was referring, but last month the organization issued an alert about attacks that installed a backdoor program called BlackEnergy on industrial control systems. ICS-CERT had reasons to believe at the time that the campaign also targeted Siemens' SIMATIC WinCC among products from other vendors, although the attack vector for WinCC was unknown.

According to an advisory published by Siemens last week, the newly patched flaws affect SIMATIC WinCC 7.3, 7.2, 7.0 SP3, 7.0 SP2 and earlier versions. Versions 8.1, 8.0, 7.1 SP4 and earlier of the SIMATIC PCS 7 distributed control system and version 13 of the TIA Portal engineering software are also affected because they include WinCC.

The company released WinCC 7.2 Update 9 and WinCC 7.3 Update 2 to address the flaws. SIMATIC PCS users are advised to upgrade to version 8.0 SP2 with WinCC V7.2 Update 9 or version 8.1 with WinCC V7.3 Update 2. TIA Portal users should upgrade to version 13 Update 6.

Siemens is also working on updates for individual PCS components that will be released in the future, namely OpenPCS 7 V8.0.1 Update 5 and V8.1 Update 1; Route Control V8.0.1 Update 4 and V8.1 Update 1 and BATCH V8.0.1 Update 11 and V8.1.1 Update 1.

The company advised administrators to run WinCC servers and engineering stations only within trusted networks, to ensure they communicate only through encrypted channels -- by using VPN tunnels or by activating the Encrypted Communications feature in WinCC -- and to restrict access to WinCC servers to trusted entities only. Customers should also use up-to-date application whitelisting software and virus scanners, the company said.

The number of attacks against SCADA users has grown this year. Since June, security researchers have identified two malware campaigns targeting such systems: Havex and BlackEnergy.

Join the CSO newsletter!

Error: Please check your email address.

Tags siemenspatchesIndustrial Control Systems Cyber Emergency Response TeamintrusionsecurityExploits / vulnerabilitiesmalware

More about CustomersICSASiemensV7

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place