Siemens Security patches July 2022

Siemens has released numerous advisories that has 46 vulnerabilities affecting the company’s products. Two advisories are for flaws that have been rated critical with a CVSS score of 10.

Three critical and high-severity vulnerabilities in the SIMATIC CP 1543-1 communication processor. The exploitation of the flaws can lead to arbitrary code execution with elevated privileges, but attacks can only be launched if the Remote Connect Server VPN feature is used the feature is not enabled by default.

The second advisory describes one critical and one high-severity vulnerability in the SIMATIC eaSie digital assistant. The bugs can be exploited remotely to send arbitrary requests to the system and cause a DoS condition.

One critical vulnerability addressed in Siemens’ latest round of advisories is a DHCP issue that affects older SINAMICS Perfect Harmony GH180 drives and can allow access to the drive’s internal network.

The company has also informed customers about a critical authentication bypass vulnerability in the Opcenter Quality quality management system.

SCALANCE X switches are affected by several critical and high-severity flaws that can be exploited for DoS attacks or brute force attacks that can lead to session hijacking.

Ten high-severity vulnerabilities also addressed. One of them covers 20 vulnerabilities in PADS Viewer product, which can be exploited for RCE by tricking the targeted user into opening a specially crafted file.

Other high-severity addressed includes issues in EN100 Ethernet modules, RUGGEDCOM ROS and ROX devices, SIMATIC MV500 devices, Simcenter Femap and Parasolid design tools, JT2Go and Teamcenter visualization products, and SICAM A8000 devices. They include command injection, DoS, remote code execution, and authentication issues.