CVE-2019-10918

Vulnerability

A vulnerability exists in the DCOM interface of Siemens SIMATIC PCS 7, WinCC, and WinCC (TIA Portal) products. An authenticated attacker can exploit this to execute arbitrary commands with SYSTEM privileges. Affected versions include: SIMATIC PCS 7 V8.0 and earlier (all versions), V8.1 (all versions < V8.1 with WinCC V7.3 Upd 19), V8.2 (all versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), V9.0 (all versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11); SIMATIC WinCC (TIA Portal) V13 (all versions), V14 (all versions < V14 SP1 Upd 9), V15 (all versions < V15.1 Upd 3); SIMATIC WinCC Runtime Professional V13 (all versions), V14 (all versions < V14.1 Upd 8), V15 (all versions < V15.1 Upd 3); SIMATIC WinCC V7.2 and earlier (all versions), V7.3 (all versions < V7.3 Upd 19), V7.4 (all versions < V7.4 SP1 Upd 11), V7.5 (all versions < V7.5 Upd 3). [1]

Exploitation

An attacker with network access to the DCOM interface can exploit this vulnerability. The attacker must be authenticated with a low-privileged user account, and no user interaction is required. The exact steps involve sending crafted DCOM requests to the affected system. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary commands with SYSTEM privileges, leading to full compromise of confidentiality, integrity, and availability of the affected system. [1]

Mitigation

Siemens has released updates to fix the vulnerability: for PCS 7 V8.1 (WinCC V7.3 Upd 19), V8.2 (WinCC V7.4 SP1 Upd 11), V9.0 (WinCC V7.4 SP1 Upd 11); WinCC (TIA Portal) V14 SP1 Upd 9, V15.1 Upd 3; WinCC Runtime Professional V14.1 Upd 8, V15.1 Upd 3; WinCC V7.3 Upd 19, V7.4 SP1 Upd 11, V7.5 Upd 3. Users should apply the appropriate updates. At the time of advisory publication, no public exploitation was known. [1]