CVE-2019-6577

Vulnerability

The integrated web server in multiple Siemens SIMATIC HMI devices and WinCC versions is vulnerable to Cross-Site Scripting (XSS) attacks. Affected products include SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15.1 Update 1), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900, and KTP900F (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Advanced (All versions < V15.1 Update 1), SIMATIC WinCC Runtime Professional (All versions < V15.1 Update 1), SIMATIC WinCC (TIA Portal) (All versions < V15.1 Update 1), and SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions) [1]. The XSS occurs if an attacker can modify particular parts of the device configuration via SNMP [1].

Exploitation

An attacker with network access to the affected system and system privileges can exploit this vulnerability. The attacker first uses SNMP with a hardcoded community string (CVE-2019-6572) to modify certain parts of the device configuration, injecting malicious script [1]. Then, user interaction is required, such as a victim accessing the web server, which executes the injected script [1]. Low skill level is needed for exploitation [1].

Impact

Successful exploitation compromises the confidentiality and integrity of the affected system [1]. An attacker could achieve XSS, leading to disclosure of sensitive information or unauthorized actions [1]. Additionally, through the SNMP vector, an attacker could read/write variables on the device [1].

Mitigation

Siemens has released updates for most affected products. Update SIMATIC HMI Comfort Panels, Comfort Outdoor Panels, KTP Mobile Panels, WinCC Runtime Advanced, WinCC Runtime Professional, and WinCC (TIA Portal) to V15.1 Update 1 [1]. For SIMATIC HMI Classic Devices, no fix is available; users should apply defense-in-depth measures, such as restricting network access and monitoring SNMP traffic [1]. No public exploitation is known at the time of publication [1].