CVE-2019-10918 : Security Advisory and Response

A security flaw has been discovered in various versions of SIMATIC PCS 7 and SIMATIC WinCC (TIA Portal) software. This vulnerability allows an authenticated attacker who has network access to the DCOM interface to execute arbitrary commands with SYSTEM privileges. The flaw can be exploited by an attacker who has network access to the affected system, and it does not require any user interaction. Successful exploitation of this flaw could compromise the confidentiality, integrity, and availability of the affected system. It is important to note that there have been no reported instances of this vulnerability being exploited publicly at the time of this advisory publication.

Understanding CVE-2019-10918

This section provides an overview of the vulnerability and its impact.

What is CVE-2019-10918?

CVE-2019-10918 is a security vulnerability found in various versions of Siemens AG's SIMATIC PCS 7 and SIMATIC WinCC (TIA Portal) software. The vulnerability allows an authenticated attacker to execute arbitrary commands with SYSTEM privileges through the DCOM interface.

The Impact of CVE-2019-10918

The exploitation of this vulnerability could lead to severe consequences:

Unauthorized execution of commands with SYSTEM privileges
Compromise of system confidentiality, integrity, and availability
No user interaction required for successful exploitation

Technical Details of CVE-2019-10918

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

The vulnerability in SIMATIC PCS 7 and SIMATIC WinCC (TIA Portal) software allows an authenticated attacker to execute arbitrary commands with SYSTEM privileges via the DCOM interface.

Affected Systems and Versions

The following versions of Siemens AG's software are affected:

SIMATIC PCS 7 V8.0 and earlier
SIMATIC PCS 7 V8.1
SIMATIC PCS 7 V8.2
SIMATIC PCS 7 V9.0
SIMATIC WinCC (TIA Portal) V13
SIMATIC WinCC (TIA Portal) V14
SIMATIC WinCC (TIA Portal) V15
SIMATIC WinCC Runtime Professional V13
SIMATIC WinCC Runtime Professional V14
SIMATIC WinCC Runtime Professional V15
SIMATIC WinCC V7.2 and earlier
SIMATIC WinCC V7.3
SIMATIC WinCC V7.4
SIMATIC WinCC V7.5

Exploitation Mechanism

The vulnerability can be exploited by an authenticated attacker with network access to the DCOM interface, requiring no user interaction for successful execution of arbitrary commands with SYSTEM privileges.

Mitigation and Prevention

This section outlines steps to mitigate and prevent exploitation of the vulnerability.

Immediate Steps to Take

Apply security patches provided by Siemens AG promptly
Restrict network access to the affected systems
Monitor network traffic for any suspicious activity

Long-Term Security Practices

Regularly update and patch software to the latest versions
Implement strong authentication mechanisms
Conduct security training for system administrators

Patching and Updates

Siemens AG may release patches to address this vulnerability; ensure timely installation of these patches to secure the systems.