OTPulse

Siemens SINAMICS Medium Voltage Products Telnet (Update A)

Plan PatchCVSS 8.1ICS-CERT ICSA-21-131-13May 11, 2021
SiemensManufacturing
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

SINAMICS medium-voltage drive products have a vulnerability in their integrated or connected HMI (SIMATIC HMI) image that allows unauthenticated Telnet access. Successful exploitation grants an attacker full remote access to the HMI, enabling them to read process data and issue control commands to the motor drives. Only HMI image versions prior to v16 Update 3a are affected. No firmware updates are available for the SINAMICS drive products themselves; the vulnerability must be mitigated by updating the HMI image and restricting network access to the Telnet interface.

What this means
What could happen
An attacker with network access to the Telnet port could gain full control of the HMI (human-machine interface) panel, allowing them to view sensitive process data, alter operational commands, or disrupt monitoring and control of medium-voltage motor drives.
Who's at risk
Manufacturing facilities using Siemens SINAMICS medium-voltage drive products (GH150, SH150, GL150, SM150i, SM150, GM150, SM120, SL150 series) with integrated or connected HMI panels. This affects any plant operating these drives for motor control in production lines, pump stations, compressor systems, or other critical medium-voltage motor applications where process visibility and control through the HMI is essential.
How it could be exploited
An attacker sends a Telnet connection request to the HMI's Telnet port (default port 23) from the network. If Telnet is enabled and no authentication is configured or enforced, the attacker gains shell access to the HMI system without providing credentials, then executes commands to modify process parameters or disable safety monitoring.
Prerequisites
  • Network connectivity to the HMI Telnet port (port 23, or custom port if configured)
  • Telnet service must be enabled on the HMI panel
  • No authentication required or weak authentication configuration on the Telnet interface
Remotely exploitable over networkNo authentication required (if default configuration)Low complexity exploitation (Telnet protocol is simple)Unauthenticated access to HMINo patch available for affected drive products (patch only addresses HMI image)
Exploitability
Some exploitation risk — EPSS score 1.7%
Affected products (16)
16 EOL
ProductAffected VersionsFix Status
SINAMICS GH150All versionsNo fix (EOL)
SINAMICS GL150 (with option X30)All versionsNo fix (EOL)
SINAMICS GM150 (with option X30)All versionsNo fix (EOL)
SINAMICS SH150All versionsNo fix (EOL)
SINAMICS SL150All versionsNo fix (EOL)
Remediation & Mitigation
0/6
Do now
0/3
WORKAROUNDDisable Telnet service on HMI panels if remote management is not required
HARDENINGRestrict network access to HMI Telnet port (port 23) using firewall rules to allow only authorized engineering and maintenance workstations
HARDENINGConfigure strong authentication (username/password or certificate-based) on Telnet if the service must remain enabled
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HOTFIXUpdate SIMATIC HMI image to v16 Update 4 or later for affected installations
HOTFIXUpdate SIMATIC HMI image to v15 SP1 Update 6 or later for older installations
Mitigations - no patch available
0/1
The following products have reached End of Life with no planned fix: SINAMICS GH150, SINAMICS GL150 (with option X30), SINAMICS GM150 (with option X30), SINAMICS SH150, SINAMICS SL150, SINAMICS SM120, SINAMICS SM150, SINAMICS SM150i, SINAMICS GH150: All versions, SINAMICS SH150: All versions, SINAMICS SM150i: All versions, SINAMICS SM150: All versions, SINAMICS GM150 (with option X30): All versions, SINAMICS SM120: All versions, SINAMICS SL150: All versions, SINAMICS GL150 (with option X30): All versions. Apply the following compensating controls:
HARDENINGDeploy network segmentation to isolate HMI panels on a separate VLAN from general corporate networks
View full CISA ICS-CERT advisory
API: /api/v1/advisories/331b319f-7f8f-4453-bca4-004fd6c9929c

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Siemens SINAMICS Medium Voltage Products Telnet (Update A) | CVSS 8.1 - OTPulse