CVE-2016-7090 in SCALANCE M-800
Summary
by MITRE
The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2022
The vulnerability identified as CVE-2016-7090 affects Siemens SCALANCE M-800 and S615 industrial network modules running firmware versions prior to 4.02. These devices are part of Siemens' industrial communication infrastructure and are designed for use in harsh industrial environments where reliable network connectivity is essential. The affected modules incorporate an integrated web server that provides remote management capabilities through web-based interfaces. This web server is critical for system administrators to configure and monitor industrial network equipment, making it a prime target for attackers seeking unauthorized access to industrial control systems.
The technical flaw resides in the implementation of session management within the web server's security protocols. Specifically, when the web server establishes secure https connections, it fails to properly configure the session cookie with the secure flag. This flag is a critical security parameter that instructs web browsers to only transmit the cookie over encrypted connections. Without this flag, session cookies can be transmitted over unencrypted http connections, making them vulnerable to interception during network transmission. The vulnerability represents a classic improper implementation of security controls, which falls under the CWE-614 category of sensitive data exposure due to insufficient security configuration.
The operational impact of this vulnerability is significant within industrial control system environments where security is paramount. Remote attackers can exploit this weakness by intercepting network traffic using packet sniffing tools or by performing man-in-the-middle attacks. When an attacker successfully captures the session cookie, they can impersonate legitimate users and gain unauthorized access to the industrial network modules. This access could enable attackers to modify network configurations, disrupt operations, or potentially escalate privileges to gain deeper access to connected industrial control systems. The vulnerability is particularly dangerous because it affects devices that are often deployed in critical infrastructure environments where operational continuity and security are essential.
The vulnerability aligns with several ATT&CK framework techniques including T1566 for credential access through network sniffing and T1071 for application layer protocol usage. Organizations should implement immediate mitigations including firmware updates to version 4.02 or later, which addresses the secure flag implementation issue. Network segmentation and monitoring should be enhanced to detect suspicious traffic patterns. Additional security controls such as network access controls, intrusion detection systems, and regular security assessments should be implemented. The vulnerability demonstrates the importance of proper security configuration management in industrial environments and highlights the need for comprehensive security testing of network infrastructure components. Organizations should also consider implementing additional authentication mechanisms beyond session cookies to provide defense in depth against credential theft attacks.