Siemens SIMATIC Drive Controller Global Key insufficiently protected credentials

Summaryinfo

A vulnerability was found in Siemens SIMATIC Drive Controller, SIMATIC ET 200SP Open Controller CPU 1515SP PC, SIMATIC ET 200SP Open Controller CPU 1515SP PC2, SIMATIC S7-1200 CPU, SIMATIC S7-1500 CPU, SIMATIC S7-1500 Software Controller and SIMATIC S7-PLCSIM Advanced and classified as problematic. Impacted is an unknown function of the component Global Key Handler. Executing a manipulation can lead to insufficiently protected credentials. The identification of this vulnerability is CVE-2022-38465. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Siemens SIMATIC Drive Controller, SIMATIC ET 200SP Open Controller CPU 1515SP PC, SIMATIC ET 200SP Open Controller CPU 1515SP PC2, SIMATIC S7-1200 CPU, SIMATIC S7-1500 CPU, SIMATIC S7-1500 Software Controller and SIMATIC S7-PLCSIM Advanced (SCADA Software) and classified as problematic. This vulnerability affects an unknown code of the component Global Key Handler. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. The CWE definition for the vulnerability is CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. As an impact it is known to affect confidentiality. CVE summarizes:

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.

The weakness was shared 10/11/2022 as ssa-568427. The advisory is shared for download at cert-portal.siemens.com. This vulnerability was named CVE-2022-38465 since 08/19/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• SCADA Software

Vendor

• Siemens

Name

• SIMATIC Drive Controller
• SIMATIC ET 200SP Open Controller CPU 1515SP PC
• SIMATIC ET 200SP Open Controller CPU 1515SP PC2
• SIMATIC S7-1200 CPU
• SIMATIC S7-1500 CPU
• SIMATIC S7-1500 Software Controller
• SIMATIC S7-PLCSIM Advanced

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion