CVE-2020-28397 : Vulnerability Insights and Analysis
Learn about CVE-2020-28397 affecting Siemens products like SIMATIC Drive Controller, S7-1200 CPU, and more. Find out how attackers could exploit this vulnerability and steps to prevent unauthorized access.
A vulnerability has been identified in various Siemens products due to an incorrect authorization check, potentially allowing attackers to extract information from affected devices.
Understanding CVE-2020-28397
What is CVE-2020-28397?
The CVE-2020-28397 vulnerability affects multiple Siemens products, including SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2, SIMATIC S7 PLCSIM Advanced, SIMATIC S7-1200 CPU family, SIMATIC S7-1500 CPU family, SIMATIC S7-1500 Software Controller, and TIM 1531 IRC. The issue arises from an incorrect authorization check in the affected components.
The Impact of CVE-2020-28397
The vulnerability could allow attackers to extract information about access-protected PLC program variables over port 102/tcp from affected devices when reading multiple attributes simultaneously.
Technical Details of CVE-2020-28397
Vulnerability Description
The vulnerability stems from an incorrect authorization check in the affected Siemens products, potentially leading to unauthorized access to sensitive information.
Affected Systems and Versions
- SIMATIC Drive Controller family: All versions < V2.9.2
- SIMATIC ET 200SP Open Controller CPU 1515SP PC2: All versions < V21.9
- SIMATIC S7 PLCSIM Advanced: All versions > V2 < V4
- SIMATIC S7-1200 CPU family: Version V4.4
- SIMATIC S7-1500 CPU family: All versions > V2.5 < V2.9.2
- SIMATIC S7-1500 Software Controller: All versions > V2.5 < V21.9
- TIM 1531 IRC: Version V2.1
Exploitation Mechanism
The vulnerability can be exploited by attackers to extract information over port 102/tcp by reading multiple attributes simultaneously from the affected devices.
Mitigation and Prevention
Immediate Steps to Take
- Apply the provided patches or updates from Siemens to address the vulnerability.
- Implement network segmentation to restrict access to vulnerable devices.
- Monitor network traffic for any suspicious activities.
Long-Term Security Practices
- Regularly update and patch all software and firmware in the affected products.
- Conduct security assessments and audits to identify and mitigate potential vulnerabilities.
Patching and Updates
It is crucial to apply the latest patches and updates released by Siemens to mitigate the CVE-2020-28397 vulnerability.