OTPulse

Siemens SIMATIC S7-1500 CPU

Plan PatchCVSS 7.5ICS-CERT ICSA-19-036-04Jan 8, 2019
Siemens
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

SIMATIC S7-1500 CPU family contains an input validation weakness in the web interface. The device fails to properly validate incoming messages on ports 80/tcp and 443/tcp. An attacker can send a specially crafted message that causes the CPU to crash and stop responding, resulting in a denial of service to the automation process. This affects firmware versions 2.0 through 2.4 (no fix available—hardware restrictions prevent upgrade path) and versions 1.8.5 and below (fixed in 2.5+). The vulnerability has a CVSS score of 7.5 (high) with a network vector requiring no authentication and low attack complexity.

What this means
What could happen
An attacker with network access to the CPU could send specially crafted messages that cause the device to become unresponsive, disrupting water treatment or power distribution operations until it is manually restarted.
Who's at risk
Water utilities and electric distribution operators running SIMATIC S7-1500 CPUs for process automation. This affects any programmable logic controller using the S7-1500 family, including related ET200 variants and SIPLUS industrial-grade models used in water treatment plants, pump stations, and power distribution automation.
How it could be exploited
An attacker on the network sends malformed input to the web interface (port 80 or 443) of the SIMATIC S7-1500 CPU. The CPU fails to properly validate the input and crashes, becoming unresponsive to all commands and causing the automation process to halt.
Prerequisites
  • Network access to ports 80/tcp and 443/tcp of the affected SIMATIC S7-1500 CPU
  • No authentication required
  • Device must be running firmware version 2.0 through 2.4 (most critical gap) or versions 1.8.5 and below
remotely exploitableno authentication requiredlow complexity attackaffects availability (denial of service)gap in patch coverage (v2.0-2.4 have no fix)
Exploitability
Some exploitation risk — EPSS score 1.1%
Affected products (2)
1 with fix1 pending
ProductAffected VersionsFix Status
SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): All≥ V2.0 and <V2.5No fix yet
SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): All≤ V1.8.52.5 or higher or when this is not possible (because of Hardware restrictions)
Remediation & Mitigation
0/5
Do now
0/1
WORKAROUNDIf hardware restrictions prevent upgrading to version 2.5, restrict network access to ports 80/tcp and 443/tcp using firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade SIMATIC S7-1500 CPU firmware to version 2.5 or higher
Long-term hardening
0/3
HARDENINGApply cell protection concept to isolate the CPU from untrusted network segments
HARDENINGSegment the control system network from the business network with firewalls
HARDENINGReview and implement Siemens' operational guidelines for Industrial Security
View full CISA ICS-CERT advisory
API: /api/v1/advisories/9dc8bfd0-34d4-4d11-a308-676baafcca55

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Siemens SIMATIC S7-1500 CPU | CVSS 7.5 - OTPulse