ICS Advisory: Siemens Mendix Forgot Password Module

Summary:

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. The advisory provides information on a vulnerability in the Mendix Forgot Password Module, which allows an unauthenticated remote attacker to determine if a user is valid or not, enabling a brute force attack with valid users.

Affected products include Mendix Forgot Password modules prior to specific versions (V3.7.3, V4.1.3, V5.4.0) across various Mendix versions (7, 8, 9, 10). Siemens has identified mitigations, including updating to specified versions, and recommends implementing additional security measures such as minimizing network exposure, using firewalls, and securing remote access.

CISA recommends users take defensive measures to minimize the risk of exploitation, including impact analysis, risk assessment, and implementing recommended cybersecurity strategies.