OTPulse
FeedAboutContact

ICSA-18-317-07 Siemens SIMATIC IT Production Suite

Plan Patch7.7ICS-CERT ICSA-18-317-07Nov 13, 2018
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

SIMATIC IT Production Suite versions prior to 7.1 Upd3 contain an authentication bypass vulnerability (CWE-287) that allows unauthenticated attackers to gain unauthorized access to the application. SIMATIC IT LMS in all versions is affected and will not receive a vendor patch. SIMATIC IT UA Discrete Manufacturing versions 1.2 through 2.4 are affected. The vulnerability is remotely exploitable over the network with high impact on confidentiality and integrity of production data.

What this means
What could happen
An attacker could bypass authentication controls on the SIMATIC IT Production Suite, gaining unauthorized access to manufacturing execution systems and potentially modifying production orders, process data, or disrupting production operations.
Who's at risk
Manufacturing facilities using Siemens SIMATIC IT Production Suite should prioritize this update. Primary concern is the SIMATIC IT LMS product line, which has no planned fix and will require network isolation. Facilities relying on SIMATIC IT for production planning, job scheduling, or discrete manufacturing execution are most at risk.
How it could be exploited
An attacker with network access to the SIMATIC IT server exploits an authentication bypass vulnerability (CWE-287) to gain unauthorized access without valid credentials. This could allow direct manipulation of production data, job scheduling, or system configuration affecting manufacturing operations.
Prerequisites
  • Network access to SIMATIC IT Production Suite server
  • No valid credentials required
remotely exploitableno authentication requiredaffects production systemsno fix available for SIMATIC IT LMS
Exploitability
Moderate exploit probability (EPSS 3.4%)
Affected products (7)
6 with fix1 EOL
ProductAffected VersionsFix Status
SIMATIC IT Production Suite<V7.1 V7.1 Upd37.1 Upd3
SIMATIC IT LMSAll versionsNo fix (EOL)
SIMATIC IT UA Discrete Manufacturing<V1.27.1 Upd3
SIMATIC IT UA Discrete Manufacturing:V1.2V1.27.1 Upd3
SIMATIC IT UA Discrete Manufacturing:V1.3V1.37.1 Upd3
SIMATIC IT UA Discrete Manufacturing:V2.3V2.37.1 Upd3
SIMATIC IT UA Discrete Manufacturing:V1.4V2.47.1 Upd3
Remediation & Mitigation
0/4
Do now
0/1
SIMATIC IT LMS
WORKAROUNDFor SIMATIC IT LMS, implement compensating controls such as firewall rules to restrict network access to the application to trusted engineering workstations only
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

SIMATIC IT Production Suite
HOTFIXUpdate SIMATIC IT Production Suite to version 7.1 Upd3 or later
SIMATIC IT UA Discrete Manufacturing
HOTFIXUpdate SIMATIC IT UA Discrete Manufacturing (all versions) to version 7.1 Upd3 or later
Mitigations - no patch available
0/1
SIMATIC IT LMS has reached End of Life. The vendor will not release a patch. Apply the following compensating controls:
HARDENINGSegment the production network to limit access to SIMATIC IT servers from untrusted networks
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/b9da62a0-f647-4e31-9c6c-1e486054a0b8