CVE-2018-4832

Vulnerability

A denial-of-service vulnerability exists in the RPC service of multiple Siemens industrial automation and control products. Affected versions include all releases of OpenPCS 7 V7.1 and earlier, V8.0, V8.2, and V8.1 prior to Upd5; OpenPCS 7 V9.0 prior to Upd1; SIMATIC BATCH V7.1 and earlier, V8.0 prior to SP1 Upd21, V8.1 prior to SP1 Upd16, V8.2 prior to Upd10, V9.0 prior to SP1; SIMATIC NET PC Software V14 prior to SP1 Update 14 and V15 prior to SP1; SIMATIC PCS 7 V7.1 and earlier, V8.0, V8.1, V8.2 prior to SP1, V9.0 prior to SP1; SIMATIC Route Control V7.1 and earlier, V8.0, V8.1, V8.2, and V9.0 prior to Upd1; SIMATIC WinCC Runtime Professional V13 prior to SP2 Upd2 and V14 prior to SP1 Upd5; SIMATIC WinCC V7.2 prior to Upd 15, V7.3 prior to Upd 16, V7.4 prior to SP1 Upd 4; and SPPA-T3000 Application Server prior to Service Pack R8.2 SP2 [1]. The vulnerability is triggered by specially crafted messages sent to the RPC service of the affected products.

Exploitation

An attacker must have network access to the Application Server of the affected product [1]. No authentication or user interaction is required. By sending a specially crafted message to the RPC service, the attacker causes a denial-of-service condition. The communication functionality, both remote and local, is disrupted until the system is rebooted.

Impact

Successful exploitation leads to a denial-of-service condition on the remote and local communication functionality of the affected product. A system reboot is required to restore full operation. There is no indication of data breach or code execution; the impact is solely on availability.

Mitigation

Siemens has released updates for many of the affected products: OpenPCS 7 V8.1 Upd5 (available), OpenPCS 7 V9.0 Upd1 (available), SIMATIC BATCH V8.0 SP1 Upd21, V8.1 SP1 Upd16, V8.2 Upd10, V9.0 SP1 (available), SIMATIC NET PC Software V14 SP1 Update 14, V15 SP1 (available), SIMATIC PCS 7 V8.2 SP1, V9.0 SP1 (available), SIMATIC Route Control V9.0 Upd1 (available), SIMATIC WinCC Runtime Professional V13 SP2 Upd2, V14 SP1 Upd5 (available), SIMATIC WinCC V7.2 Upd 15, V7.3 Upd 16, V7.4 SP1 Upd 4 (available), and SPPA-T3000 R8.2 SP2 (available) [1]. For products not patched (e.g., older versions), users should upgrade to a supported version. As of the advisory publication, no public exploitation was known [1]. This vulnerability is not listed on the CISA KEV.