CVE-2019-10917

Vulnerability

CVE-2019-10917 describes an uncaught exception vulnerability (CWE-248) in the project file loading process of multiple Siemens SIMATIC products. Affected products include SIMATIC PCS 7 V8.0 and earlier (all versions), V8.1 (all versions < V8.1 with WinCC V7.3 Upd 19), V8.2 (all versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), V9.0 (all versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11); SIMATIC WinCC (TIA Portal) V13 (all versions), V14 (all versions < V14 SP1 Upd 9), V15 (all versions < V15.1 Upd 3); SIMATIC WinCC Runtime Professional V13 (all versions), V14 (all versions < V14.1 Upd 8), V15 (all versions < V15.1 Upd 3); and SIMATIC WinCC V7.2 and earlier (all versions), V7.3 (all versions < V7.3 Upd 19), V7.4 (all versions < V7.4 SP1 Upd 11), V7.5 (all versions < V7.5 Upd 3) [1].

Exploitation

An attacker must have local access to a project file. The attacker can craft a malicious project file with a specially crafted TCP/IP configuration that triggers an uncaught exception when the file is loaded by the application. No user interaction is required beyond the loading of the project file [1].

Impact

Successful exploitation results in a denial-of-service condition, leading to an application crash or hang, compromising the availability of the affected system. The vulnerability does not allow arbitrary code execution or data exfiltration [1].

Mitigation

Siemens has released updates for the affected products as detailed in the ICS advisory [1]. For products such as SIMATIC WinCC (TIA Portal) V13 and SIMATIC WinCC Runtime Professional V13, which are no longer supported, no fix is available; users should upgrade to a supported version. Specific fixed versions include WinCC V7.3 Upd 19, WinCC V7.4 SP1 Upd 11, WinCC V7.5 Upd 3, TIA Portal V14 SP1 Upd 9, TIA Portal V15.1 Upd 3, WinCC Runtime Professional V14.1 Upd 8, and WinCC Runtime Professional V15.1 Upd 3. No public exploitation has been reported as of the advisory publication date [1].