CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
76.6%
Successful exploitation of these vulnerabilities could allow an attacker to affect the availability, read sensitive data, and gain remote code execution on the affected devices.
The following Siemens products are affected:
By performing a flooding attack against the web server, an attacker might be able to gain read access to the device’s memory, and reveal confidential information.
CVE-2020-10037 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
An attacker with access to the device’s web server might be able to execute administrative commands without authentication.
CVE-2020-10038 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An attacker in a privileged network position between a legitimate user and the web server might be able to conduct a man-in-the-middle attack and gain read and write access to the transmitted data.
CVE-2020-10039 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker with local access to the device might be able to retrieve passwords in clear text.
CVE-2020-10040 has been assigned to this vulnerability. A CVSS v3 base score of 6.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
A stored cross-site-scripting (XSS) vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user.
CVE-2020-10041 has been assigned to this vulnerability. A CVSS v3 base score of 9.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
A buffer overflow in various positions of the web application might enable an attacker with access to the web application to execute arbitrary code over the network.
CVE-2020-10042 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
The web server could allow cross-site scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link.
CVE-2020-10043 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L).
An attacker with access to the network could be able to install specially crafted firmware on the device.
CVE-2020-10044 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An error in the challenge-response procedure could allow an attacker to replay authentication traffic and gain access to protected areas of the web application.
CVE-2020-10045 has been assigned to this vulnerability. A CVSS v3 base score of 8.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H).
Siemens thanks the following parties for their efforts:
Siemens recommends applying updates, where available:
Siemens has identified the following specific workarounds and mitigations that users can apply to reduce the risk:
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens operational guidelines for Industrial Security and following the recommendations in the product manuals.
For additional information, please refer to Siemens Security Advisory SSA-305120
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
CISA also recommends users take the following measures to protect themselves from social engineering attacks:
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10037
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10038
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10039
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10040
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10041
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10042
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10043
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10044
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10045
cert-portal.siemens.com/operational-guidelines-industrial-security.pdf
cert-portal.siemens.com/productcert/pdf/ssa-305120.pdf
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-20-196-03
cwe.mitre.org/data/definitions/120.html
cwe.mitre.org/data/definitions/125.html
cwe.mitre.org/data/definitions/294.html
cwe.mitre.org/data/definitions/306.html
cwe.mitre.org/data/definitions/306.html
cwe.mitre.org/data/definitions/311.html
cwe.mitre.org/data/definitions/79.html
cwe.mitre.org/data/definitions/80.html
cwe.mitre.org/data/definitions/916.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
support.industry.siemens.com/cs/products/7kg9661-1aa00-1aa0
support.industry.siemens.com/cs/products/7kg9663-1aa00-1aa0
twitter.com/CISAgov
twitter.com/intent/tweet?text=Siemens%20SICAM%20MMU%2C%20SICAM%20T%2C%20and%20SICAM%20SGU+https://www.cisa.gov/news-events/ics-advisories/icsa-20-196-03
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-20-196-03&title=Siemens%20SICAM%20MMU%2C%20SICAM%20T%2C%20and%20SICAM%20SGU
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-20-196-03
www.oig.dhs.gov/
www.us-cert.gov/ics
www.us-cert.gov/ics
www.us-cert.gov/ics/recommended-practices
www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B
www.us-cert.gov/ncas/tips/ST04-014
www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf
www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Siemens%20SICAM%20MMU%2C%20SICAM%20T%2C%20and%20SICAM%20SGU&body=www.cisa.gov/news-events/ics-advisories/icsa-20-196-03
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
76.6%