Titre :Plusieurs vulnérabilités dans Siemens SIMATIC HMI Risque

Titre :Plusieurs vulnérabilités dans Siemens SIMATIC HMI
Numéro de Référence
Risque
Impact
: 7461409/15
: Important
: Important
Systèmes affectés
• SIMATIC HMI Basic Panels 2nd Generation:
• V13: Toutes versions < WinCC (TIA Portal) V13 SP1 Upd2
• SIMATIC HMI Comfort Panels:
• V12: Toutes versions < WinCC (TIA Portal) V12 SP1 Upd5
• V13: Toutes versions < WinCC (TIA Portal) V13 SP1 Upd2
• SIMATIC WinCC Runtime Advanced:
• V12: Toutes versions < WinCC Runtime Advanced V12 SP1 Upd5
• V13: Toutes versions < WinCC Runtime Advanced V13 SP1 Upd2
• SIMATIC WinCC Runtime Professional:
• V13: Toutes versions < WinCC (TIA Portal) V13 SP1 Upd2
• SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal):
• V12: Toutes versions < WinCC (TIA Portal) V12 SP1 Upd5
• V13: Toutes versions < WinCC (TIA Portal) V13 SP1 Upd4
• SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal):
• V12: Toutes versions < WinCC (TIA Portal) V12 SP1 Upd5
• V13: Toutes versions < WinCC (TIA Portal) V13 SP1 Upd4
• SIMATIC HMI Multi Panels (WinCC TIA Portal):
• V12: Toutes versions < WinCC (TIA Portal) V12 SP1 Upd5
• V13: Toutes versions < WinCC (TIA Portal) V13 SP1 Upd4
• SIMATIC NET PC-Software V12 and V13:
• SIMATIC NET PC-Software V12: Toutes versions < V12 SP2 HF3
Direction Générale de la Sécurité des Systèmes d’Information,
Centre de Veille de Détection et de Réaction aux Attaques
Informatiques, Méchouar Saïd,
B.P. 1048 Rabat – Tél : 05 37 57 21 47 – Fax : 05 37 57 20 53
Email : [email protected]
‫مديرية تدبير مركز اليقظة والرصد‬, ‫المديرية العامة لمن نظم المعلومات‬
‫ الرباط‬1048 .‫ب‬.‫ ص‬،‫ المشور السعيد‬، ‫والتصدي للهجمات المعلوماتية‬
05 37 57 20 53 :‫ – فاكس‬05 37 57 21 47 :‫هاتف‬
[email protected] ‫البريد اللكتروني‬
• SIMATIC NET PC-Software V13: Toutes versions < V13 HF1
• SIMATIC WinCC V7.X:
• Toutes versions prior to V7.2
• V7.2: Toutes version < V7.2 Upd11
• V7.3: Toutes versions < V7.3 Upd4, and
• SIMATIC PCS 7: Toutes versions prior to V8.1 SP1.
Bilan de la vulnérabilité
Plusieurs vulnérabilités ont été corrigées dans Siemens SIMATIC HMI . Ces
vulnérabilités peuvent être exploitées à distance pour causer une attaque
man-in-the-middle, déni de service et élévation des privilèges.
Solution
•
•
•
•
•
Veuillez vous référer au bulletin de sécurité Seimens :
https://support.industry.siemens.com/cs/ww/en/view/109311724
https://support.industry.siemens.com/cs/ww/en/view/78683919
https://support.industry.siemens.com/cs/ww/en/view/79684570
https://support.industry.siemens.com/cs/ww/en/view/109311423
Risque :
• Déni de service.
• Elevation de privilèges.
• Attaque man-in-the-middle.
Annexe
• SIMATIC HMI Basic Panels 2nd Generation:
• V13: Update to WinCC (TIA Portal) V13 SP1 Upd2:
https://support.industry.siemens.com/cs/ww/en/view/109311724 (link is external),
• SIMATIC HMI Comfort Panels:
• V12: Update to WinCC (TIA Portal) V12 SP1 Upd5:
https://support.industry.siemens.com/cs/ww/en/view/78683919 (link is external)
• V13: Update to WinCC (TIA Portal) V13 SP1 Upd2:
https://support.industry.siemens.com/cs/ww/en/view/109311724 (link is external)
• SIMATIC WinCC Runtime Advanced:
• V12: Update to V12 SP1 Upd5:
Direction Générale de la Sécurité des Systèmes d’Information,
Centre de Veille de Détection et de Réaction aux Attaques
Informatiques, Méchouar Saïd,
B.P. 1048 Rabat – Tél : 05 37 57 21 47 – Fax : 05 37 57 20 53
Email : [email protected]
‫مديرية تدبير مركز اليقظة والرصد‬, ‫المديرية العامة لمن نظم المعلومات‬
‫ الرباط‬1048 .‫ب‬.‫ ص‬،‫ المشور السعيد‬، ‫والتصدي للهجمات المعلوماتية‬
05 37 57 20 53 :‫ – فاكس‬05 37 57 21 47 :‫هاتف‬
[email protected] ‫البريد اللكتروني‬
•
•
•
•
•
•
•
•
•
•
https://support.industry.siemens.com/cs/ww/en/view/79684570 (link is external)
• V13: Update to V13 SP1 Upd2:
https://support.industry.siemens.com/cs/ww/en/view/109311423 (link is external)
SIMATIC WinCC Runtime Professional:
• V13: Update to V13 SP1 Upd2:
https://support.industry.siemens.com/cs/ww/en/view/109439573 (link is external)
SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal):
• V12: Update to WinCC (TIA Portal) V12 SP1 Upd5:
https://support.industry.siemens.com/cs/ww/en/view/78683919 (link is external)
• V13: Update to WinCC (TIA Portal) V13 SP1 Upd4:
https://support.industry.siemens.com/cs/ww/en/view/109311724 (link is external)
SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal):
• V12: Update to WinCC (TIA Portal) V12 SP1 Upd5:
https://support.industry.siemens.com/cs/ww/en/view/78683919 (link is external)
• V13: Update to WinCC (TIA Portal) V13 SP1 Upd4:
https://support.industry.siemens.com/cs/ww/en/view/109311724 (link is external)
SIMATIC HMI Multi Panels (WinCC TIA Portal):
• V12: Update to WinCC (TIA Portal) V12 SP1 Upd5:
https://support.industry.siemens.com/cs/ww/en/view/78683919 (link is external)
• V13: Update to WinCC (TIA Portal) V13 SP1 Upd4:
https://support.industry.siemens.com/cs/ww/en/view/109311724 (link is external)
SIMATIC NET PC-Software V12 and V13:
SIMATIC NET PC-Software V12: Update to V12 SP2 HF3:
https://support.industry.siemens.com/cs/ww/en/view/109475388 (link is external),
SIMATIC NET PC-Software V13: Update to V13 HF1:
https://support.industry.siemens.com/cs/ww/en/view/109475388 (link is external),
SIMATIC WinCC V7.X:
• V7.2 and all versions prior to V7.2: Update to V7.2 Upd11:
https://support.industry.siemens.com/cs/de/en/view/109478834 (link is external)
• V7.3: Update to V7.3 Upd4:
https://support.industry.siemens.com/cs/de/en/view/109475497 (link is external)
SIMATIC Automation Tool: Update to V1.0.2:
https://support.industry.siemens.com/cs/ww/en/view/98161300 (link is external), and .
SIMATIC PCS 7 V8.1: Update to SP1:
https://support.industry.siemens.com/cs/ww/en/view/108463041 (link is external)
Direction Générale de la Sécurité des Systèmes d’Information,
Centre de Veille de Détection et de Réaction aux Attaques
Informatiques, Méchouar Saïd,
B.P. 1048 Rabat – Tél : 05 37 57 21 47 – Fax : 05 37 57 20 53
Email : [email protected]
‫مديرية تدبير مركز اليقظة والرصد‬, ‫المديرية العامة لمن نظم المعلومات‬
‫ الرباط‬1048 .‫ب‬.‫ ص‬،‫ المشور السعيد‬، ‫والتصدي للهجمات المعلوماتية‬
05 37 57 20 53 :‫ – فاكس‬05 37 57 21 47 :‫هاتف‬
[email protected] ‫البريد اللكتروني‬