news.mlab.sh
Back to the feed
vulnerability

Siemens SIPLUS and SIMATIC Products

1d ago · CISA Advisories · CISA
HighCVSS 7.8
Summary

Multiple Siemens industrial products are vulnerable to a "Copy Fail" vulnerability in the Linux kernel. Siemens has released updated firmware versions and recommends immediate updates to mitigate the risk. The vulnerability affects a wide range of devices including HMIs, controllers, and edge devices, spanning several product lines and firmware versions. The issue stems from a flaw in the cryptographic algorithm used for data copying, potentially allowing unauthorized access to sensitive information. Siemens is urging customers to prioritize patching these devices to prevent exploitation.

Siemens has issued a security advisory regarding a critical vulnerability, dubbed "Copy Fail," affecting several of its industrial automation products. The vulnerability resides within the Linux kernel and could allow for unauthorized data access and potential system compromise. The issue is primarily related to the cryptographic algorithm used for data copying, specifically within the algif_aead component.

The affected products include a vast range of Siemens HMIs (Human-Machine Interfaces), controllers, and industrial edge devices. These devices are used in critical infrastructure sectors such as manufacturing, energy, water treatment, and commercial facilities worldwide. The vulnerability is present in firmware versions prior to V21.2.1.

Specifically, the vulnerability is found in the following products:

  • SIMATIC AX Runtime Core Linux Common Debian
  • SIMATIC HMI MTP1000
  • SIMATIC HMI MTP1200 Comfort Panel neutral (6AV2128-3KB36-0AX1) < V21.2.1
  • SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3MB27-1BX0) < V21.2.1
  • SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3MB27-0BX0) < V21.2.1
  • SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3MB27-0AX0) < V21.2.1
  • SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3MB57-1BX0) < V21.2.1
  • SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3MB57-0BX0) < V21.2.1
  • SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3MB57-0AX0) < V21.2.1
  • SIMATIC HMI MTP1200 Unified Basic (6AV2123-3MB32-0AW0) < V21.2.1
  • SIMATIC HMI MTP1200 Unified Comfort Panel (6AV2128-3MB06-0AX1) < V21.2.1
  • SIMATIC HMI MTP1200 Unified Comfort Panel hygienic (6AV2128-3MB40-0AX0) < V21.2.1
  • SIMATIC AX Runtime Core Linux Platform Container Common Debian Development
  • SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3QB27-1BX0) < V21.2.1
  • SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3QB27-0BX0) < V21.2.1
  • SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3QB27-0AX0) < V21.2.1
  • SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3QB57-1BX0) < V21.2.1
  • SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3QB57-0BX0) < V21.2.1
  • SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3QB57-0AX0) < V21.2.1
  • SIMATIC HMI MTP1500 Unified Comfort Panel (6AV2128-3QB06-0AX1) < V21.2.1
  • SIMATIC HMI MTP1500 Unified Comfort Panel hygienic (6AV2128-3QB40-0AX0) < V21.2.1
  • SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design (6AV2128-3QB70-0AX0) < V21.2.1
  • SIMATIC HMI MTP1500 Unified Comfort Panel neutral design (6AV2128-3QB36-0AX1) < V21.2.1
  • SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom) (6AV2128-3UB27-1BX0) < V21.2.1
  • SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit (6AV2128-3UB27-0BX0) < V21.2.1
  • SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top) (6AV2128-3UB27-0AX0) < V21.2.1
  • SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom) (6AV2128-3UB57-1BX0) < V21.2.1
  • SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension (6AV2128-3UB57-0BX0) < V21.2.1
  • SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top) (6AV2128-3UB57-0AX0) < V21.2.1
  • SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) < V21.2.1
  • SIMATIC IPC Industrial Edge Device OS (IED-OS) < V21.2.1

Siemens is urging customers to immediately update their devices to the latest firmware versions to mitigate the risk of exploitation. The company has released security updates and guidance on how to perform these updates. Failure to address this vulnerability could lead to unauthorized access to sensitive data and potential disruption of industrial operations. The affected products are critical components in various industries, including manufacturing, energy, and water treatment, highlighting the importance of timely patching.

Read the full article at CISA Advisories