CVE-2021-37172 : Vulnerability Insights and Analysis

A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0) that could allow an attacker to bypass authentication and download arbitrary programs to the PLC.

Understanding CVE-2021-37172

This CVE pertains to a vulnerability in the SIMATIC S7-1200 CPU family, affecting devices that fail to authenticate against configured passwords when provisioned using TIA Portal V13.

What is CVE-2021-37172?

The vulnerability in SIMATIC S7-1200 CPU family allows attackers using TIA Portal V13 to bypass authentication and download arbitrary programs to the PLC.

The Impact of CVE-2021-37172

This vulnerability can be exploited by attackers to gain unauthorized access to the PLC, potentially leading to operational disruptions and unauthorized program changes.

Technical Details of CVE-2021-37172

The vulnerability arises from a failure to authenticate configured passwords when devices are provisioned using TIA Portal V13.

Vulnerability Description

Affected devices allow attackers to circumvent authentication and upload malicious programs to the PLC, compromising its integrity.

Affected Systems and Versions

The vulnerability affects SIMATIC S7-1200 CPU family devices running V4.5.0 and provisioned using TIA Portal V13.

Exploitation Mechanism

Attackers can exploit this vulnerability by using TIA Portal V13 or later versions to bypass authentication and upload unauthorized programs to the PLC.

Mitigation and Prevention

To protect systems from CVE-2021-37172, immediate action and long-term security practices are essential.

Immediate Steps to Take

Update to TIA Portal V13 SP1 or any later version to provision devices securely.
Implement strict network access controls and monitor PLC activities for unusual behavior.

Long-Term Security Practices

Regularly update firmware and apply security patches to mitigate known vulnerabilities.
Restrict access to critical devices and ensure strong password policies are enforced.

Patching and Updates

Work with Siemens to apply patches and updates that address the authentication bypass vulnerability in SIMATIC S7-1200 CPU family devices running V4.5.0.