A critical vulnerability has been identified in Siemens Simatic programmable logic controllers (PLCs), enabling potential attackers to exploit hard-coded, global private cryptographic keys. This security flaw could allow attackers to gain substantial control over these devices, posing a significant threat to industrial operations.
According to a report from the industrial cybersecurity firm Claroty, the vulnerability allows an attacker to bypass all access protections inherent in Siemens SIMATIC devices and associated TIA Portal software. This exploit could facilitate a range of advanced attacks, including full control over affected units. “The secret keys could lead to an irreparable compromise of the entire SIMATIC S7-1200/1500 product line,” the report stated emphatically.
Assigned the identifier CVE-2022-38465, this vulnerability scores 9.3 on the CVSS scale, marking it as critically severe. Siemens responded to this discovery with security updates issued on October 11, 2022, to address the issue effectively.
The potential ramifications are particularly concerning for various Siemens products including the SIMATIC Drive Controller (all versions prior to 2.9.2) and the SIMATIC S7-1500 CPU family, among others. Claroty also revealed that they were able to exploit a previously disclosed vulnerability (CVE-2020-15782) to obtain read and write access to the controllers, thereby retrieving the private key. This capability not only aids in circumventing established access controls but could allow comprehensive manipulation of every PLC within the affected product lines.
The situation bears resemblance to another severe vulnerability found in Rockwell Automation PLCs last year (CVE-2021-22681), which similarly allowed unauthorized remote access to controllers. Claroty observed similar risks associated with the Studio 5000 Logix Designer software, which could expose secret cryptographic keys.
To mitigate risks associated with this critical vulnerability, Siemens recommends utilizing legacy PG/PC and HMI communications exclusively within trustworthy network environments. They urge companies to secure access to TIA Portal and PLCs, ensuring that unauthorized connections are thwarted. Furthermore, Siemens has taken proactive steps by encrypting communications in TIA Portal version 17 using Transport Layer Security (TLS).
The cybersecurity challenges faced by Siemens are part of a larger trend exposing weaknesses in industrial software systems. Just this past June, Claroty identified over a dozen vulnerabilities in Siemens’ SINEC network management system, emphasizing the growing urgency for enhanced cybersecurity measures in industrial settings.
Considering the complexity and implications of these vulnerabilities, business owners must remain vigilant. The identification of CVE-2022-38465 serves as a stark reminder of the ongoing cybersecurity threats in industrial sectors. By understanding the potential tactics and techniques outlined in frameworks like the MITRE ATT&CK Matrix, stakeholders can better prepare for and respond to evolving threats.
In summary, while Siemens acts to address these vulnerabilities, the evolving nature of cyber threats necessitates a proactive and rigorous approach to security across all sectors reliant on industrial controls and automation technologies.