Siemens AG issued fixes for eight vulnerabilities that were affecting its industrial product lines. The most serious of the flaws was a cross-site scripting vulnerability in Siemens’ SCALANCE firewall product. Once exploited the flaw could allow a hacker to gain unauthorized access to industrial networks.
The vulnerability, CVE-2018-16555, has a CVSS score calculated at 8.2 (high severity).
For those who don’t know the SCALANCE S firewall is a product used to protect secure industrial networks from untrusted network traffic and allows filtering incoming and outgoing network connections in different ways. Impacted by this flaw are Siemens S602, S612, S623, S627-2M SCALANCE devices with software versions older than V126.96.36.199.
A hacker can use this flaw by crafting a malicious link and tricking an administrator – who is logged into the web server – to click that link. Once the click has been made, the hacker can execute commands on the web server, on the administrator’s behalf.
This exploit is not easy to make and takes some time and effort to carry out a successful attack; for now, no exploit of the vulnerability has been discovered in the wild.
Siemens fixed this vulnerability by releasing a software update (V188.8.131.52). Researchers are also advising customers to update immediately and “only access links from trusted sources in the browser you use to access the SCALANCE S administration website.”
Remember everything can be hacked. In order to stay away from any threats related to the cyber world, we recommend the install of antivirus for Windows or antivirus for Mac on every device that you own, depending on which OS your device is running. If you are a company, it is also recommended to hire every year a specialized cybersecurity company that will run annual tests on your company’s network. These tests include penetration testing and ethical hacking tests;
Another serious vulnerability that was fixed is CVE-2018-16556. This vulnerability happens due to an improper input validation flaw in certain Siemens S7-400 CPUs. If it is exploited properly the flaw will crash the device being accessed which may require a manual reboot or firmware re-image to bring the system back to normal operation. To do so, a hacker must craft special packets and sent them to Port 102/TCP via Ethernet interface, via PROFIBUS, or via multi-point interfaces (MPI). Once an action like this is done a manual reboot is required to resume normal operation.
This flaw affects Siemens IEC 61850 system configurator, DIGSI 5, DIGSI 4, SICAM PAS/PQS, SICAM PQ Analyzer, and SICAM SCC.
New threats and cyber attacks are appearing every day, an unprotected system or terminal could lead to catastrophic consequences and losses. Experts are advising every user to keep its software and hardware updated.
Keep in mind that our modern society is dependent on computers, mobile devices, and the use of the internet always stay safe and secured.
We would continue to monitor the cybersecurity world. Meanwhile, users should keep a keen eye out for any cyber attacks. Remember to use an antivirus for Windows or antivirus for Mac in every device that you own, depending on which OS your machine is running, If you are a company we recommend to hire every year a specialized cybersecurity company that will run annual tests on your company’s network, tests like this include: penetration testing and ethical hacking.