Multiple vulnerabilities in Siemens SIMATIC RF16XX, RF18XX and RF600R
| Risk | Medium |
| Patch available | NO |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2019-11479 CVE-2019-11477 CVE-2019-11478 |
| CWE-ID | CWE-400 CWE-190 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SIMATIC RF600R Server applications / SCADA systems SIMATIC RF166C Server applications / SCADA systems SIMATIC RF188CI Hardware solutions / Routers & switches, VoIP, GSM, etc SIMATIC RF188C Hardware solutions / Routers & switches, VoIP, GSM, etc SIMATIC RF186CI Hardware solutions / Routers & switches, VoIP, GSM, etc SIMATIC RF186C Hardware solutions / Routers & switches, VoIP, GSM, etc SIMATIC RF185C Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Resource exhaustion
EUVDB-ID: #VU18947
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-11479
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to presence of hard-coded MSS value (48 bytes) in the Linux kernel source code. A remote attacker can fragment TCP resend queues significantly more than if a larger MSS were enforced and perform denial of service (DoS) attack.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSIMATIC RF600R: All versions
SIMATIC RF188CI: All versions
SIMATIC RF188C: All versions
SIMATIC RF186CI: All versions
SIMATIC RF186C: All versions
SIMATIC RF185C: All versions
SIMATIC RF166C: All versions
CPE2.3- cpe:2.3:a:siemens:simatic_rf600r:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf188ci:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf188c:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf186ci:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf186c:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf185c:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_rf166c:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-19-253-03
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Integer overflow
EUVDB-ID: #VU18813
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-11477
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to integer overflow when handling TCP Selective Acknowledgments (SACKs) due to incorrect processing of TCP_SKB_CB(skb)->tcp_gso_segs value in Linux kernel. A remote non-authenticated attacker can send specially crafted network traffic to the affected system, trigger integer overflow and render the system unavailable.
Successful exploitation of the vulnerability allows a remote attacker to perform denial of service (DoS) attack.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSIMATIC RF600R: All versions
SIMATIC RF188CI: All versions
SIMATIC RF188C: All versions
SIMATIC RF186CI: All versions
SIMATIC RF186C: All versions
SIMATIC RF185C: All versions
SIMATIC RF166C: All versions
CPE2.3- cpe:2.3:a:siemens:simatic_rf600r:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf188ci:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf188c:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf186ci:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf186c:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf185c:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_rf166c:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-19-253-03
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Resource exhaustion
EUVDB-ID: #VU18946
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-11478
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to an error when processing TCP Selective Acknowledgment (SACK) sequences within the Linux kernel TCP retransmission queue implementation in tcp_fragment. A remote non-authenticated attacker can send specially crafted network traffic to the affected system and perform a denial of service (DoS) attack.
Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSIMATIC RF600R: All versions
SIMATIC RF188CI: All versions
SIMATIC RF188C: All versions
SIMATIC RF186CI: All versions
SIMATIC RF186C: All versions
SIMATIC RF185C: All versions
SIMATIC RF166C: All versions
CPE2.3- cpe:2.3:a:siemens:simatic_rf600r:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf188ci:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf188c:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf186ci:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf186c:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:simatic_rf185c:*:*:*:*:*:*:*:*
- cpe:2.3:a:siemens:simatic_rf166c:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-19-253-03
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
