**ATTENTION:**Exploitable from an adjacent network/low skill level to exploit.
Vendor: Siemens
Equipment: Devices using the PROFINET Discovery and Configuration Protocol (DCP)
Vulnerability: Denial of Service
This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-02H Siemens devices using the PROFINET Discovery and Configuration Protocol that was published January 18, 2018, on the NCCIC/ICS-CERT web site.
--------- Begin Update I Part 1 of 2 --------
Siemens reports that these vulnerabilities affect the following products using PROFINET DCP:
--------- End Update I Part 1 of 2 ----------
Successful exploitation of these vulnerabilities could cause the targeted device to enter a denial-of-service condition, which may require human interaction to recover the system.
The attacker must have network access to the local Ethernet segment (Layer 2).
Siemens strongly recommends verifying the affected products are protected as described in PROFINET Security Guidelines and Siemens Operational Guidelines in order to run the devices in a protected IT environment.
<https://www.profibus.com/download/profinet-security-guideline/>
<https://www.siemens.com/cert/operational-guidelines-industrial-security>
--------- Begin Update I Part 2 of 2 --------
Siemens provides firmware updates fixing the vulnerabilities for the following affected products and recommends users update to the new fixed version:
SIMATIC CP 443-1 Std: Update to V3.2.17
<https://support.industry.siemens.com/cs/ww/en/view/109745387>
SIMATIC CP 443-1 Adv: Update to V3.2.17
<https://support.industry.siemens.com/cs/ww/en/view/109745388>
SIMATIC CP 1243-1 and SIMATIC CP 1243-1 IRC: Update to V2.1.82
<https://support.industry.siemens.com/cs/ww/en/view/109749515>
SIMATIC CM 1542-1: Update to V2.0
<https://support.industry.siemens.com/cs/ww/en/view/109744924>
SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, and CP 1543SP-1: Update to V1.0.15
<https://support.industry.siemens.com/cs/ww/en/view/109749255>
SIMATIC CP 1543-1: Update to V2.1
<https://support.industry.siemens.com/cs/ww/en/view/109747253>
SIMATIC RF650R, RF680R, RF685R: Update to V3.0
<https://support.industry.siemens.com/cs/ww/en/view/109743740>
SIMATIC CP 1616, CP 1604, DK-16xx PN IO: Update to V2.7
<https://support.industry.siemens.com/cs/ww/en/view/109743058>
SCALANCE X-200: Update to V5.2.2:
<https://support.industry.siemens.com/cs/ww/en/view/109752018>
SCALANCE X-300/X408: Update to V4.1.0
<https://support.industry.siemens.com/cs/ww/en/view/109748080>
SCALANCE X414: Update to V3.10.2
<https://support.industry.siemens.com/cs/ww/en/view/109747276>
SCALANCE XM400: Update to V6.1
<https://support.industry.siemens.com/cs/ww/en/view/109748934>
SCALANCE XR500: Update to V6.1
<https://support.industry.siemens.com/cs/ww/en/view/109748937>
SCALANCE W700: Update to V6.1.0
<https://support.industry.siemens.com/cs/ww/en/view/109744953>
SCALANCE M-800, S615: Update to V04.3
<https://support.industry.siemens.com/cs/ww/en/view/109750006>
Softnet PROFINET IO for PC-based Windows systems: Upgrade to V14 SP1:
<https://support.industry.siemens.com/cs/ww/en/view/109747482>
IE/PB-Link: Upgrade to V3.0
<https://support.industry.siemens.com/cs/ww/en/view/109744504>
SITOP PSU8600 PROFINET: Update to V1.2.0
<https://support.industry.siemens.com/cs/ww/en/view/102295547>
SITOP UPS1600 PROFINET: Update to V2.2.0
<https://support.industry.siemens.com/cs/ww/en/view/79207181>
SIMATIC ET 200 Interface modules for PROFINET IO
SIMATIC ET 200AL: Update to V1.0.2:
<https://support.industry.siemens.com/cs/ww/en/view/109479281>
SIMATIC ET 200SP: Update to V4.1.0
<https://support.industry.siemens.com/cs/de/de/view/78648144>
SIMATIC PN/PN Coupler: Upgrade to V4.0
<https://support.industry.siemens.com/cs/de/en/view/109749637>
Development/Evaluation Kits for PROFINET IO
DK Standard Ethernet Controller: Update to V4.1.1 Patch04
EK-ERTEC 200P PN IO: Update to V4.4.0 Patch01
EK-ERTEC 200 PN IO: Update to V4.2.1 Patch03
Updates for Development/Evaluation Kits for PROFINET IO can be obtained via ComDeC at [email protected] or [email protected]
SIMATIC S7-200 SMART: Contact the local Siemens representative or customer support to update to V2.3
<https://w3.siemens.com/aspa_app/>
SIMATIC S7-300 including F and T: Update to V3.X.14
<https://support.industry.siemens.com/cs/ww/de/ps/13752/dl> or
<https://support.industry.siemens.com/cs/ww/en/ps/13752/dl>
SIMATIC S7-400 PN/DP V6 Incl. F: Update to V6.0.6:
<https://support.industry.siemens.com/cs/de/en/view/109474874>
SIMATIC S7-400 PN/DP V7 Incl. F: Update to V7.0.2:
<https://support.industry.siemens.com/cs/ww/en/view/109752685>
SIMATIC S7-400-H V6: Update to V6.0.7
<https://support.industry.siemens.com/cs/document/109474550>
SIMATIC S7-CPU 410: Update to V8.2
<https://support.industry.siemens.com/cs/ww/en/view/109476571>
SIMATIC S7-1200 including F: Update to V4.2.1
<https://support.industry.siemens.com/cs/ww/en/view/109741461>
SIMATIC S7-1500 including F, T and TF: Update to V2.1
<https://support.industry.siemens.com/cs/ww/en/view/109478459>
SIMATIC S7-1500 Software Controller including F: Update to V2.1
<https://support.industry.siemens.com/cs/ww/en/view/109478528>
SINAMICS
SINAMICS DCM w. PN: Update to V1.4 SP1 HF5
<https://support.industry.siemens.com/cs/ww/en/view/44029688>
SINAMICS DCP w. PN: Update to V1.2 HF1:
<https://support.industry.siemens.com/cs/ww/en/view/109474935>
SINAMICS G110M/G120(C/P/D) w. PN: Update to V4.7 SP6 HF3
<https://support.industry.siemens.com/cs/ww/en/view/109482659>
SINAMICS G130 and G150 V4.7: Update to V4.7 HF27
<https://support.industry.siemens.com/cs/ww/en/view/103433117>
SINAMICS G130 and G150 V4.8: Update to V4.8 HF4
<https://support.industry.siemens.com/cs/ww/en/view/109742040>
SINAMICS S110 w. PN: Update to V4.4 SP3 HF5
<https://support.industry.siemens.com/cs/de/en/view/109474320>
SINAMICS S120 V4.7: Update to V4.7 HF27
<https://support.industry.siemens.com/cs/de/en/view/92522512>
SINAMICS S120 V4.8: Update to V4.8 HF4
<https://support.industry.siemens.com/cs/de/en/view/109740193>
SINAMICS S150 V4.7: Update to V4.7 HF27
<https://support.industry.siemens.com/cs/ww/en/view/103433117>
SINAMICS S150: V4.8: Update to V4.8 HF4
<https://support.industry.siemens.com/cs/ww/en/view/109742040>
SINAMICS V90 w. PN: Update to V1.1
<https://support.industry.siemens.com/cs/document/109746210>
SIMOCODE pro V PROFINET: Update to V2.0.0
<https://support.industry.siemens.com/cs/ww/en/view/109749989>
SIMOTION: Update to V4.5 HF1
<https://support.industry.siemens.com/cs/ww/en/view/109742328>
SINUMERIK 828D V4.5: Update to V4.5 SP6 HF2
SINUMERIK software can be obtained from the local Siemens account manager
SINUMERIK 828D V4.7: Update to V4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager
SINUMERIK 840D sl
V4.5 and prior: Update to V4.5 SP6 HF8
V4.7: Update to V4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager.
--------- End Update I Part 2 of 2 ----------
Siemens is preparing updates for the remaining affected products and recommends the following mitigations in the meantime:
Apply cell protection concept
Use VPN for protecting network communication between cells
Apply Defense-in-Depth
As a general security measure Siemens and PNO strongly recommend protecting industrial control systems networks with appropriate mechanisms. Siemens encourages users to verify that the affected products are protected as described in PNO Security Guidelines and Siemens operational guidelines in order to run the devices in a protected IT environment.
<https://www.siemens.com/cert/operational-guidelines-industrial-security>
For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security Advisory SSA-293562 at the following location:
<http://www.siemens.com/cert/en/cert-security-advisories.htm>
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the NCCIC Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
Specially crafted PROFINET DCP broadcast packets could cause a denial-of-service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected.
CVE-2017-2680 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial-of-service condition in that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.
This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices.
CVE-2017-2681 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Duan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team reported these vulnerabilities directly to Siemens.
Critical Infrastructure Sectors: Critical Manufacturing, Food and Agriculture, Chemical, Energy, Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
**Company Headquarters Location:**Germany
ics-cert.us-cert.gov
ics-cert.us-cert.gov
twitter.com/icscert
twitter.com/icscert
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-2680
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-2681
www.addthis.com/bookmark.php?url=https%3A%2F%2Fics-cert.us-cert.gov%2Fadvisories%2FICSA-17-129-02I
www.dhs.gov
www.dhs.gov/report-cyber-risks
www.siemens.com/cert/en/cert-security-advisories.htm
www.us-cert.gov/accessibility/
www.us-cert.gov/pdf/
www.us-cert.gov/privacy/
www.us-cert.gov/tlp/
www.us-cert.gov/tlp/
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/20.html
ics-cert.us-cert.gov/
ics-cert.us-cert.gov/content/recommended-practices
ics-cert.us-cert.gov/Report-Incident?
ics-cert.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
ics-cert.us-cert.gov/tips/ICS-TIP-12-146-01B
support.industry.siemens.com/cs/de/de/view/78648144
support.industry.siemens.com/cs/de/en/view/109474320
support.industry.siemens.com/cs/de/en/view/109474874
support.industry.siemens.com/cs/de/en/view/109740193
support.industry.siemens.com/cs/de/en/view/109749637
support.industry.siemens.com/cs/de/en/view/92522512
support.industry.siemens.com/cs/document/109474550
support.industry.siemens.com/cs/document/109746210
support.industry.siemens.com/cs/ww/de/ps/13752/dl
support.industry.siemens.com/cs/ww/en/ps/13752/dl
support.industry.siemens.com/cs/ww/en/view/102295547
support.industry.siemens.com/cs/ww/en/view/103433117
support.industry.siemens.com/cs/ww/en/view/103433117
support.industry.siemens.com/cs/ww/en/view/109474935
support.industry.siemens.com/cs/ww/en/view/109476571
support.industry.siemens.com/cs/ww/en/view/109478459
support.industry.siemens.com/cs/ww/en/view/109478528
support.industry.siemens.com/cs/ww/en/view/109479281
support.industry.siemens.com/cs/ww/en/view/109482659
support.industry.siemens.com/cs/ww/en/view/109741461
support.industry.siemens.com/cs/ww/en/view/109742040
support.industry.siemens.com/cs/ww/en/view/109742040
support.industry.siemens.com/cs/ww/en/view/109742328
support.industry.siemens.com/cs/ww/en/view/109743058
support.industry.siemens.com/cs/ww/en/view/109743740
support.industry.siemens.com/cs/ww/en/view/109744504
support.industry.siemens.com/cs/ww/en/view/109744924
support.industry.siemens.com/cs/ww/en/view/109744953
support.industry.siemens.com/cs/ww/en/view/109745387
support.industry.siemens.com/cs/ww/en/view/109745388
support.industry.siemens.com/cs/ww/en/view/109747253
support.industry.siemens.com/cs/ww/en/view/109747276
support.industry.siemens.com/cs/ww/en/view/109747482
support.industry.siemens.com/cs/ww/en/view/109748080
support.industry.siemens.com/cs/ww/en/view/109748934
support.industry.siemens.com/cs/ww/en/view/109748937
support.industry.siemens.com/cs/ww/en/view/109749255
support.industry.siemens.com/cs/ww/en/view/109749515
support.industry.siemens.com/cs/ww/en/view/109749989
support.industry.siemens.com/cs/ww/en/view/109750006
support.industry.siemens.com/cs/ww/en/view/109752018
support.industry.siemens.com/cs/ww/en/view/109752685
support.industry.siemens.com/cs/ww/en/view/44029688
support.industry.siemens.com/cs/ww/en/view/79207181
twitter.com/share?url=https%3A%2F%2Fics-cert.us-cert.gov%2Fadvisories%2FICSA-17-129-02I
w3.siemens.com/aspa_app/
www.facebook.com/sharer.php?u=https%3A%2F%2Fics-cert.us-cert.gov%2Fadvisories%2FICSA-17-129-02I
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
www.profibus.com/download/profinet-security-guideline/
www.siemens.com/cert/operational-guidelines-industrial-security
www.siemens.com/cert/operational-guidelines-industrial-security
www.us-cert.gov/forms/feedback?helpful=no&document=ICSA-17-129-02I Siemens devices using the PROFINET Discovery and Configuration Protocol (Update I)&trackingNumber=&url=https://ics-cert.us-cert.gov/advisories/ICSA-17-129-02I&site_name=ICS-CERT
www.us-cert.gov/forms/feedback?helpful=somewhat&document=ICSA-17-129-02I Siemens devices using the PROFINET Discovery and Configuration Protocol (Update I)&trackingNumber=&url=https://ics-cert.us-cert.gov/advisories/ICSA-17-129-02I&site_name=ICS-CERT
www.us-cert.gov/forms/feedback?helpful=yes&document=ICSA-17-129-02I Siemens devices using the PROFINET Discovery and Configuration Protocol (Update I)&trackingNumber=&url=https://ics-cert.us-cert.gov/advisories/ICSA-17-129-02I&site_name=ICS-CERT