Siemens Releases Update for Simatic Net PC Software V8.1 SP1

Siemens has recently released updates for several of its products, including the Simatic Net PC Software V8.1 SP1, to address a critical vulnerability that could allow an attacker to cause a denial-of-service condition on the remote and local communication functionality of affected devices.

The vulnerability, identified as CVE-2018-4832, was discovered by Vladimir Dashchenko from Kaspersky Lab and independent researcher cdev1. It affects several Siemens products, including SIMATIC WinCC 7.3, SIMATIC WinCC 7.2, SIMATIC WinCC Runtime Professional v14, SIMATIC Route Control v9.0, SIMATIC PCS 7 v8.2, SIMATIC Route Control v8.1, SIMATIC Route Control v8.0, and others.

According to Siemens, the vulnerability is caused by improper input validation in the RPC service of affected products, which could allow an attacker to send specially crafted messages that cause a denial-of-service condition on remote and local communication functionality.

To exploit this vulnerability, an attacker would need to send specially crafted messages to the RPC service of the affected product. Siemens reports that exploitation of this vulnerability requires low skill level and can be done remotely.

The company recommends that users update their products to the latest version to mitigate the risk of exploitation. A reboot of the system is required after updating to recover remote and local communication functionality.

In addition to releasing updates for the affected products, Siemens has also assigned a CVSS v3 base score of 7.5 to this vulnerability, with a CVSS vector string of (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

This updated advisory is a follow-up to an earlier advisory published on the NCCIC/ICS-CERT website in February 2019.

In summary, Siemens has released updates for its Simatic Net PC Software V8.1 SP1 and other affected products to address a critical vulnerability that could allow attackers to cause a denial-of-service condition. Users are advised to update their products as soon as possible to mitigate the risk of exploitation.

Simatic net pc software v8.1 sp1