ICS Advisory: Siemens Solid Edge

Summary:

CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. The vendor, Siemens, recommends protecting network access to devices and configuring the environment according to their operational guidelines for industrial security.

The advisory reports 11 vulnerabilities in Solid Edge, a Siemens product, with CVEs ranging from 2023-49121 to 2023-49132. The vulnerabilities are primarily heap-based buffer overflows, out-of-bounds reads and writes, stack-based buffer overflows, and access of uninitialized pointers.

Successful exploitation of these vulnerabilities could allow an attacker to execute code in the context of the current process. Siemens recommends updating to V223.0 Update 10 or later version, avoiding opening untrusted files from unknown sources, and protecting network access to devices.

CISA recommends minimizing network exposure, isolating control system networks, and using secure remote access methods, such as Virtual Private Networks (VPNs).