CVE-2019-10916

Vulnerability

An SQL injection vulnerability (CWE-89) exists in the project file handling of multiple Siemens SIMATIC products, including SIMATIC PCS 7, WinCC, and WinCC (TIA Portal) [1]. Affected versions include SIMATIC PCS 7 V8.0 and earlier (all versions), V8.1 prior to V8.1 with WinCC V7.3 Upd 19, V8.2 prior to V8.2 SP1 with WinCC V7.4 SP1 Upd 11, V9.0 prior to V9.0 SP2 with WinCC V7.4 SP1 Upd 11; SIMATIC WinCC (TIA Portal) V13 (all versions), V14 prior to V14 SP1 Upd 9, V15 prior to V15.1 Upd 3; SIMATIC WinCC Runtime Professional V13 (all versions), V14 prior to V14.1 Upd 8, V15 prior to V15.1 Upd 3; SIMATIC WinCC V7.2 and earlier (all versions), V7.3 prior to V7.3 Upd 19, V7.4 prior to V7.4 SP1 Upd 11, V7.5 prior to V7.5 Upd 3 [1]. The vulnerability allows an attacker with access to the project file to inject SQL commands.

Exploitation

An attacker with network access to the project file can exploit this vulnerability remotely with low skill level [1]. The attacker crafts a malicious project file containing an SQL injection payload. When the affected system processes the project file, the SQL injection is triggered, allowing the attacker to execute arbitrary system commands with the privileges of the local database server [1].

Impact

Successful exploitation enables arbitrary command execution on the database server, impacting the confidentiality, integrity, and availability of the affected system [1]. The attacker gains the privileges of the local database server, which could lead to full system compromise.

Mitigation

Siemens has released updates to address this vulnerability. Fixed versions include WinCC V7.3 Upd 19, WinCC V7.4 SP1 Upd 11, WinCC V7.5 Upd 3, TIA Portal V14 SP1 Upd 9, TIA Portal V15.1 Upd 3, WinCC Runtime Professional V14.1 Upd 8, WinCC Runtime Professional V15.1 Upd 3, and corresponding updates for PCS 7 [1]. Users should apply the latest updates. No workarounds are documented. At the time of advisory publication, no public exploitation was known [1].