OTPulse
FeedAboutContact

TLS Certificate Validation Vulnerability in SINUMERIK Integrate Operate Client

Plan Patch7.4SSA-729965Jul 13, 2021
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

SINUMERIK Integrate Operate Client and related software do not properly validate TLS/SSL certificates (CWE-295). An attacker positioned on the network could spoof any SSL server certificate and conduct man-in-the-middle attacks, potentially intercepting credentials and manufacturing commands. Siemens has released updates for SINUMERIK Integrate Client versions 02, 03, and 04, and recommends updating SINUMERIK Operate to V4.8 SP8 or updating the included client component. However, many related products (SINUMERIK Manage MyMachines, MyPrograms, MyResources, MyTools; Optimize MyProgramming; and Analyze products) are not receiving fixes.

What this means
What could happen
An attacker positioned on the network between your workstation and server could intercept and spoof SSL certificates, allowing them to impersonate the SINUMERIK server, capture credentials, or modify commands sent to your manufacturing control systems without being detected.
Who's at risk
Manufacturing plants and machine tool operators using SINUMERIK Integrate or Operate clients for production management and machine control should be concerned. This affects workstations running the Integrate Client software (versions 2, 3, or 4) as well as the Operate platform (v4.8, v4.93, v4.94) and the related monitoring and analysis applications (Manage MyMachines, Manage MyPrograms, Optimize MyProgramming, Analyze MyCondition, Analyze MyPerformance). Any site managing CNC machines or manufacturing processes through these interfaces is at risk.
How it could be exploited
An attacker intercepts network traffic between the SINUMERIK Integrate Operate Client and the server. Because the client does not properly validate SSL certificates, the attacker presents a forged certificate that the client accepts as legitimate, allowing the attacker to sit in the middle of the connection and read or modify all communications.
Prerequisites
  • Network access to the communication path between SINUMERIK client workstations and servers (e.g., ability to intercept traffic or position on the network segment)
  • No user action required—the vulnerability is triggered automatically during SSL handshake
remotely exploitableman-in-the-middle attack vectoraffects management and control interfacesmultiple products without available patches
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (20)
6 with fix14 EOL
ProductAffected VersionsFix Status
SINUMERIK Integrate for Production 5.1V5.1No fix (EOL)
SINUMERIK Manage MyMachinesAll versionsNo fix (EOL)
SINUMERIK Manage MyProgramsAll versionsNo fix (EOL)
SINUMERIK Manage MyResources /ProgramsAll versionsNo fix (EOL)
SINUMERIK Manage MyResources /ToolsAll versionsNo fix (EOL)
Remediation & Mitigation
0/5
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

HOTFIXUpdate SINUMERIK Integrate Client to version 02.00.18 (if running V02.00.12 or later)
HOTFIXUpdate SINUMERIK Integrate Client to version 03.00.18 (if running V03.00.12 or later)
HOTFIXUpdate SINUMERIK Integrate Client to version 04.00.18 (if running V04.00.02 or V04.00.15 or later)
HOTFIXUpdate SINUMERIK Operate to V4.8 SP8 or update the included SINUMERIK Integrate Client component
Mitigations - no patch available
0/1
The following products have reached End of Life with no planned fix: SINUMERIK Integrate for Production 5.1, SINUMERIK Manage MyMachines, SINUMERIK Manage MyPrograms, SINUMERIK Manage MyResources /Programs, SINUMERIK Manage MyResources /Tools, SINUMERIK Manage MyTools, SINUMERIK Optimize MyProgramming /NX-Cam Editor, SINUMERIK Analyse MyCondition, SINUMERIK Analyze MyPerformance, SINUMERIK Integrate for Production 4.1, SINUMERIK Manage MyMachines /Remote, SINUMERIK Manage MyMachines /Spindel Monitor, SINUMERIK Analyze MyPerformance /OEE-Monitor, SINUMERIK Analyze MyPerformance /OEE-Tuning. Apply the following compensating controls:
HARDENINGFor products where no fix is available, implement network segmentation to isolate SINUMERIK management and control clients from untrusted networks; restrict access to servers to authorized workstations only
View full Siemens ProductCERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/0ba4e687-bec9-45f0-91eb-032f11f910df
TLS Certificate Validation Vulnerability in SINUMERIK Integrate Operate Client | CVSS 7.4 - OTPulse