OTPulse
FeedAboutContact

Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities

Low RiskICS-CERT ICSA-14-329-02DAug 28, 2014
Summary

Siemens SIMATIC WinCC, PCS 7, and TIA Portal contain insufficient access controls (CWE-284) that could allow attackers to bypass authentication mechanisms and gain unauthorized access to supervisory control systems. The vulnerability affects WinCC V7.0–V7.3, PCS 7 V7.1–V8.1, and TIA Portal V13. No patches are currently available from the vendor for any affected product line.

What this means
What could happen
An attacker could exploit insufficient access controls in WinCC, PCS 7, or TIA Portal to gain unauthorized access to the SCADA system, potentially allowing manipulation of process parameters, alarms, or logged data without proper authentication.
Who's at risk
Process automation and SCADA operators at utilities, water treatment plants, refineries, and manufacturing facilities using Siemens SIMATIC WinCC (versions 7.0–7.3), PCS 7 (versions 7.1–8.1), or TIA Portal (version 13) for supervisory control and data acquisition should prioritize mitigation of these access control vulnerabilities.
How it could be exploited
An attacker with network access to a WinCC runtime server, PCS 7 engineering or runtime station, or TIA Portal server could bypass access control mechanisms to interact with the system without valid credentials, enabling unauthorized viewing or modification of process control data.
Prerequisites
  • Network access to WinCC runtime, PCS 7, or TIA Portal server
  • No valid credentials required
No authentication requiredRemotely exploitableAffects SCADA/process control systemsNo patch available
Exploitability
Moderate exploit probability (EPSS 5.8%)
Affected products (7)
4 with fix1 pending2 EOL
ProductAffected VersionsFix Status
SIMATIC WinCC V7.2: <V7.2_Update_9<V7.2 Update 9No fix yet
SIMATIC WinCC V7.0 SP3 and prior: vers:all/*All versionsNo fix (EOL)
SIMATIC WinCC V7.3: <V7.3_Update_2<V7.3 Update 2V7.3_Update_2
SIMATIC PCS 7 V7.1 SP4 and prior: vers:all/*All versionsNo fix (EOL)
SIMATIC PCS 7 V8.0: <V8.0_SP2_with_WinCC_V7.2_Update_9<V8.0 SP2 with WinCC V7.2 Update 9V8.0_SP2_with_WinCC_V7.2_Update_9
SIMATIC PCS 7 V8.1: <with_WinCC_V7.3_Update_2<with WinCC V7.3 Update 2with_WinCC_V7.3_Update_2
TIA Portal V13 (including WinCC Professional Runtime): <V13_Update_6<V13 Update 6V13_Update_6
Remediation & Mitigation
0/4
Do now
0/3
HARDENINGSegment the engineering network and SCADA systems from the corporate network and internet using firewalls and air-gapping where feasible
WORKAROUNDRestrict network access to WinCC, PCS 7, and TIA Portal systems to trusted engineering workstations only
HARDENINGMonitor and log all access attempts to WinCC runtime servers and PCS 7 systems to detect unauthorized access
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HARDENINGReview and enforce strong authentication policies and access controls within WinCC and PCS 7 systems
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/48c0f20e-ab26-4501-9221-2087dd3277f5
Siemens SIMATIC WinCC, PCS7, and TIA Portal Vulnerabilities - OTPulse