CVE-2019-13939

Vulnerability

The vulnerability exists in the DHCP implementation of the networking component (Nucleus NET) within the Nucleus Real-Time Operating System (RTOS) [1]. By sending specially crafted DHCP packets to a device with DHCP client enabled, an attacker can change the IP address to an invalid value [1][2]. Affected products include numerous Siemens building automation and industrial devices such as APOGEE MEC/MBC/PXC (P2) (versions < V2.8.2), APOGEE PXC Compact (BACnet) (versions < V3.5.3), Desigo PXC series (multiple versions), SIMOTICS CONNECT 400 (< V0.3.0.330), and others listed in the advisory [1][2].

Exploitation

An attacker must be on the same adjacent network as the target device to send malicious DHCP packets [2]. No authentication is required, and the skill level is low [2]. The attacker crafts DHCP responses that cause the device to adopt an invalid IP address, disrupting network connectivity.

Impact

Successful exploitation results in the device obtaining an invalid IP address, leading to loss of network connectivity. This affects the availability of the device and could allow the attacker to make further configuration changes [2]. The integrity of the device's network configuration is compromised.

Mitigation

Siemens has released updates for some products: APOGEE MEC/MBC/PXC (P2) update to V2.8.2; APOGEE PXC Compact (BACnet) and TALON TC Compact (BACnet) update to V3.5.3; APOGEE PXC Compact (P2 Ethernet) and Modular (P2 Ethernet) update to V2.8.19; Desigo PXC series update to V6.00.327; SIMOTICS CONNECT 400 update to V0.3.0.330 [1]. For products where no fix is available, Siemens recommends network segmentation and disabling DHCP client if not required [1]. Capital Embedded AR Classic 431-422 has no fix planned [1].