ICS Advisory: Siemens SIMATIC CN 4100

Summary:

CISA has released a security advisory regarding Siemens SIMATIC CN 4100 product vulnerabilities. The vulnerabilities, which include Authorization Bypass Through User-Controlled Key, Improper Input Validation, and Use of Default Credentials, have a CVSS v3 score of 9.8, 7.5, and 9.8 respectively. These vulnerabilities could allow an attacker to remotely login as root, cause denial of service, or gain complete control of the device.

Mitigations include updating to version V2.7 or later, applying specific workarounds, and following general security measures such as protecting network access, configuring the environment according to Siemens' operational guidelines, and using secure remote access methods.

CISA recommends organizations perform proper impact analysis and risk assessment, implement recommended cybersecurity strategies, and report suspected malicious activity.