7 Updates Published – 1-12-21

Yesterday CISA’s NCCIC-ICS published seven updates for control system security advisories for products from Siemens.

PROFINET Update

This update provides additional information on an advisory that was originally published on October 10^th, 2019 and most recently updated on September 8^th, 2020. The new information includes:

• Updating affected version information and adding mitigation measures for or SIMATIC ET200SP IM155-6 PN HA, and

• Listing ecoPN model (6ES7148-6JG00-0BB0) as not affected.

TIA Portal Update

This update provides additional information on an advisory that was originally published on January 14^th, 2020 and most recently updated on April 14^th, 2020. The new information includes updating affected version information and adding mitigation measures for TIA Portal V14.

Simatic PCS 7 Update

This update provides additional information on an advisory that was originally published on February 11^th, 2020 and most recently updated on September 8^th, 2020. The new information includes adding mitigation measures for SIMATIC WinCC (TIA Portal) V14.

SCALANCE Update

This update provides additional information on an advisory that was originally published on April 14^th, 2020 and most recently updated on September 8^th, 2020. The new information includes removing the SCALANCE S-600 family as it is not affected.

SIMOTICS Update

This update provides additional information on an advisory that was originally published on April 14^th, 2020. The new information includes updating affected versions and adding mitigation measures for:

• Desigo PXC, and

• Desigo PXM20

SIMATIC Update

This update provides additional information on an advisory that was originally published on July 9^th, 2020 and most recently updated on December 8^th, 2020. The new information includes updating affected versions and adding mitigation measures for:

• SIMATIC STEP 7 (TIA Portal) V14, and

• SIMATIC WinCC Runtime Professional V14

Opcenter Update

This update provides additional information on an advisory that was originally published on July 14^th, 2020 and most recently updated on August 11^th, 2020. Then new information includes:

• Adding an insufficiently protected credentials vulnerability - CVE-2020-28390, and

• Updating mitigation measures

 

Additional Siemens Advisory

 

Siemens published one additional advisory that was not addressed by NCCIC-ICS yesterday. I will address that this weekend.