ICS Advisory: Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems

Summary:

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. The updated advisory concerns multiple vulnerabilities in Siemens Cerberus PRO EN and Sinteso FS20 EN product lines, affecting fire protection systems. The vulnerabilities, namely Classic Buffer Overflow, Out-of-bounds Read, and Improper Restriction of Operations within the Bounds of a Memory Buffer, can allow an unauthenticated attacker to execute arbitrary code, create a denial-of-service condition, or crash the network service. CVSS scores range from 7.5 to 10.0. Affected products include various versions of Cerberus PRO EN and Sinteso FS20 EN Engineering Tools, Fire Panels, and Cloud Distributions. Siemens has identified workarounds and mitigations, including software updates, to reduce risk.

Gist:

The advisory concerns multiple vulnerabilities in Siemens firefighting equipment, with scores ranging from 7.5 to 10.0. Affected products need software updates, and Siemens recommends protective measures, such as network segmenting and secure remote access.