OTPulse

ICSA-17-318-01_Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update F)

MonitorCVSS 6.8ICS-CERT ICSA-17-318-01Nov 14, 2017
Siemens
Attack path
Attack VectorAdjacent
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

Mathy Vanhoef discovered cryptographic weaknesses in the WPA2 implementation of multiple Siemens wireless and WLAN products. An attacker within RF range can perform a key recovery attack to derive the WPA2 encryption key, then decrypt and inject frames into the wireless communication. This affects SCALANCE W-700, W1750D, WLC711/712, SIMATIC RF650M/RF350M, and RUGGEDCOM ROX II devices. Certain product families and configurations are not vulnerable by default or when specific features are disabled: SCALANCE W1750D is safe unless Mesh or WiFi uplink are enabled; WLC711/712 are safe unless IEEE 802.11r, MeshConnect, or Client Bridge Mode are enabled; W-700 standalone access points, RX1400 in AP mode, and devices with iPCF features enabled are not affected. SIMATIC RF650M has no fix available.

What this means
What could happen
An attacker on the same wireless network segment could bypass WPA2 encryption and intercept or inject traffic into wireless communications on SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS devices, potentially allowing them to eavesdrop on or modify control commands.
Who's at risk
Water and electric utilities operating Siemens SCALANCE wireless access points and controllers, SIMATIC RF650M and RF350M RFID readers, and RUGGEDCOM ROX II hardened wireless devices are affected. This particularly impacts facilities using IEEE 802.11n wireless networks for remote monitoring, mesh networking, or WiFi uplink connectivity to PLCs, RTUs, and field devices. Organizations relying on wireless for SCADA communication, mobile operator panels, or distributed I/O should prioritize assessment.
How it could be exploited
An attacker adjacent to the wireless network (within RF range) can exploit cryptographic weaknesses in WPA2 implementation on affected WLAN devices. The attacker performs a key recovery attack to derive the WPA2 encryption key, then decrypts and potentially injects malicious frames into the wireless communication channel. This requires proximity to the WLAN and high technical skill but no authentication credentials.
Prerequisites
  • Attacker must be within wireless RF range of the affected WLAN device (adjacent network access)
  • Target device must be actively transmitting or capable of receiving wireless frames
  • High technical skill needed to execute the key recovery and frame injection attack
  • Vulnerable WLAN features must be enabled (e.g., Mesh, WiFi uplink, IEEE 802.11r, MeshConnect, Client Bridge Mode on specific models)
Remotely exploitable from adjacent network (WLAN RF range)No authentication required to launch the attackHigh skill level required (reduces immediate risk but feasible for determined attackers)Publicly disclosed vulnerabilityAffects encryption layer—impacts confidentiality and integrity of wireless trafficSIMATIC RF650M has no fix available
Exploitability
Some exploitation risk — EPSS score 1.2%
Affected products (1)
ProductAffected VersionsFix Status
SIMATIC RF650M: All< 22.3.5.16No fix (EOL)
Remediation & Mitigation
0/9
Do now
0/2
WORKAROUNDDisable Mesh and WiFi uplink functionality on SCALANCE W1750D if not required for operations
WORKAROUNDDisable IEEE 802.11r, MeshConnect, and Client Bridge Mode on SCALANCE WLC711 and WLC712 if not required (all disabled by default)
Schedule — requires maintenance window
0/6

Patching may require device reboot — plan for process interruption

HOTFIXUpdate SIMATIC RF650M and RF350M to firmware version 22.3.5.16 or later
HOTFIXUpdate SCALANCE W-700 (IEEE 802.11n) to version 6.2.1 or newer
HOTFIXUpdate SCALANCE W1750D to version 6.5.1.5-4.3.1.8 or later
HOTFIXUpdate SCALANCE WLC711 and WLC712 to version 9.21.19.003 or later
HOTFIXUpdate RUGGEDCOM ROX II for RX1400 with WLAN interface to version 2.11.2 or later
HARDENINGConfigure WLAN devices to use WPA2-CCMP (AES) encryption instead of WPA2-TKIP or WPA-GCMP where client compatibility allows
Mitigations - no patch available
0/1
SIMATIC RF650M: All has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGImplement network segmentation and defense-in-depth controls to isolate WLAN networks from critical control systems; do not rely on WPA2 encryption alone
View full CISA ICS-CERT advisory
API: /api/v1/advisories/15afb5fd-4d8b-4f44-8b48-fe815fbb8f0e

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.