CVE-2023-48364

Vulnerability

The vulnerability resides in the implementation of the Remote Procedure Call (RPC) communication protocol used in multiple Siemens products. The RPC server does not properly handle certain malformed RPC messages, leading to a denial of service condition. Affected products include OpenPCS 7 V9.1 (all versions < V9.1 SP2 UC05), SIMATIC BATCH V9.1 (all versions < V9.1 SP2 UC05), SIMATIC PCS 7 V9.1 (all versions < V9.1 SP2 UC05), SIMATIC Route Control V9.1 (all versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Professional V18 (all versions < V18 Update 4), SIMATIC WinCC Runtime Professional V19 (all versions < V19 Update 2), SIMATIC WinCC V7.4 (all versions), SIMATIC WinCC V7.5 (all versions < V7.5 SP2 Update 15), and SIMATIC WinCC V8.0 (all versions < V8.0 Update 4). [1]

Exploitation

An attacker can exploit this vulnerability by sending specially crafted malformed RPC messages to the affected RPC server. No authentication or user interaction is required; the attacker only needs network access to the target system. The attack does not require any special privileges or prior knowledge of the system configuration. [1]

Impact

Successful exploitation results in a denial of service condition in the RPC server, causing the affected product to become unresponsive or crash. This can disrupt industrial control processes and potentially lead to operational downtime. The impact is limited to availability; confidentiality and integrity are not directly affected. [1]

Mitigation

Siemens has released fixes for most affected products as detailed in advisory SSA-753746. The fixed versions are: OpenPCS 7 V9.1 SP2 UC05, SIMATIC BATCH V9.1 SP2 UC05, SIMATIC PCS 7 V9.1 SP2 UC05, SIMATIC Route Control V9.1 SP2 UC05, SIMATIC WinCC Runtime Professional V18 Update 4, SIMATIC WinCC Runtime Professional V19 Update 2, SIMATIC WinCC V7.5 SP2 Update 15, and SIMATIC WinCC V8.0 Update 4. For SIMATIC WinCC V7.4, no fix is available; users should consider upgrading to a supported version or applying network segmentation and access controls as a workaround. [1]