Siemens Opcenter Execution Discrete Crafted Packet resource consumption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Siemens Opcenter Execution Discrete, Opcenter Execution Foundation, Opcenter Execution Process, Opcenter Intelligence, Opcenter Quality, Opcenter RD, L, SIMATIC Notifier Server for Windows, SIMATIC PCS neo, SIMATIC STEP 7, SIMOCODE ES and Soft Starter ES. This impacts an unknown function. Executing a manipulation as part of Crafted Packet can lead to resource consumption. This vulnerability appears as CVE-2020-7587. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic was found in Siemens Opcenter Execution Discrete, Opcenter Execution Foundation, Opcenter Execution Process, Opcenter Intelligence, Opcenter Quality, Opcenter RD, L, SIMATIC Notifier Server for Windows, SIMATIC PCS neo, SIMATIC STEP 7, SIMOCODE ES and Soft Starter ES (SCADA Software). This vulnerability affects an unknown functionality. The manipulation as part of a Crafted Packet leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Execution Process (All versions < V3.2), Opcenter Intelligence (All versions), Opcenter Quality (All versions < V11.3), Opcenter RD&L (V8.0), SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (All versions), SIMATIC Notifier Server for Windows (All versions), SIMATIC PCS neo (All versions), SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 2), SIMOCODE ES (All versions), Soft Starter ES (All versions). Sending multiple specially crafted packets to the affected service could cause a partial remote Denial-of-Service, that would cause the service to restart itself. On some cases the vulnerability could leak random information from the remote service.

The weakness was presented 07/14/2020 (Website). The advisory is shared for download at cert-portal.siemens.com. This vulnerability was named CVE-2020-7587 since 01/21/2020. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/15/2020). The MITRE ATT&CK project declares the attack technique as T1499.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-158066 and VDB-158069 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• SCADA Software

Vendor

• Siemens

Name

• L
• Opcenter Execution Discrete
• Opcenter Execution Foundation
• Opcenter Execution Process
• Opcenter Intelligence
• Opcenter Quality
• Opcenter RD
• SIMATIC Notifier Server for Windows
• SIMATIC PCS neo
• SIMATIC STEP 7
• SIMOCODE ES
• Soft Starter ES

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion