Full Report
SIMATIC MV500 before V3.3.5 is affected by multiple vulnerabilities. Siemens has released an update for SIMATIC MV500 and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in SIMATIC MV500
## CVE Details
This advisory covers several vulnerabilities. The most critical are:
- **CVE-2022-23218 / CVE-2022-23219**: CVSS **9.8 (Critical)** | CWE-120 (Classic Buffer Overflow)
- **CVE-2023-35788**: CVSS **7.8 (High)** | CWE-787 (Out-of-bounds Write)
- **CVE-2022-44792 / CVE-2022-44793**: CVSS **6.5 (Medium)** | CWE-476 (NULL Pointer Dereference)
- **CVE-2023-3446**: CVSS **5.3 (Medium)** | CWE-834 (Excessive Iteration)
- **CVE-2023-2975**: (CVSS not provided in snippet) | OpenSSL AES-SIV bug
## Affected Systems
- **Products**: SIMATIC MV500 family (Stationary optical readers).
- **Versions**: All versions prior to V3.3.5.
- **Configurations**: Devices utilized in industrial environments for capturing printed, lasered, or punched codes.
## Vulnerability Description
The SIMATIC MV500 is affected by multiple flaws within its underlying components (glibc, Linux Kernel, OpenSSL, and Net-SNMP):
- **glibc (CVE-2022-23218/19)**: Buffer overflows in the `sunrpc` module via `svcunix_create` and `clnt_create` due to unvalidated input lengths on the stack.
- **Linux Kernel (CVE-2023-35788)**: An out-of-bounds write in the flower classifier code (`cls_flower.c`) via Geneve packets.
- **Net-SNMP (CVE-2022-44792/93)**: NULL pointer dereferences in IP scalar handling that allow a remote attacker to crash the service via crafted UDP packets.
- **OpenSSL (CVE-2023-3446)**: Excessive iteration flaw in `DH_check()` when processing Large P or Q values from untrusted sources.
## Exploitation
- **Status**: PoC available (indicated by CVSS "E:P" flag in the advisory).
- **Complexity**: Low for most network-based flaws; medium for specific cryptographic/logical flaws.
- **Attack Vector**: Network (for glibc, Net-SNMP, and OpenSSL issues); Local (for Linux Kernel OOB write).
## Impact
- **Confidentiality**: High (Potential for arbitrary code execution in glibc flaws).
- **Integrity**: High (Potential for arbitrary code execution/privilege escalation).
- **Availability**: High (Denial of Service via crashes or excessive resource consumption).
## Remediation
### Patches
- **SIMATIC MV500**: Update to **V3.3.5** or later.
- Download Link: [https://support.industry.siemens.com/cs/ww/en/view/109825816/](https://support.industry.siemens.com/cs/ww/en/view/109825816/)
### Workarounds
- **Network Segmentation**: Protect network access to devices using firewalls and VLANs.
- **Operational Guidelines**: Follow Siemens' operational guidelines for Industrial Security to ensure the device operates in a protected IT environment.
- **SNMP Control**: Restrict SNMP write access to trusted hosts only to mitigate Net-SNMP vulnerabilities.
## Detection
- **Indicators of Compromise**: Unexpected device reboots, service crashes (SNMP/Network stacks), or unusual network traffic on UDP port 161 (SNMP) or RPC-related ports.
- **Detection Methods**: Use industrial IDS/IPS signatures to monitor for stack-based overflow attempts in RPC calls and malformed Geneve packets.
## References
- Siemens Advisory: [https://cert-portal.siemens.com/productcert/html/ssa-099606.html](https://cert-portal.siemens.com/productcert/html/ssa-099606.html)
- Siemens CERT Operational Guidelines: [https://www.siemens.com/cert/operational-guidelines-industrial-security](https://www.siemens.com/cert/operational-guidelines-industrial-security)
- General Industrial Security: [https://www.siemens.com/industrialsecurity](https://www.siemens.com/industrialsecurity)