Full Report
SIMATIC Cloud Connect 7 contains multiple vulnerabilities that could allow an attacker to impact its confidentiality, integrity and availability. Siemens has released updates for the affected products and recommends to update to the latest versions.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in SIMATIC Cloud Connect 7
## CVE Details
- **CVE ID:** CVE-2023-28832, CVE-2023-29103, CVE-2023-29104, CVE-2023-29105, CVE-2023-29106, CVE-2023-29107, CVE-2023-29128
- **CVSS Score:** 3.8 – 7.2 (High)
- **CWE:** CWE-77 (Command Injection), CWE-259 (Hard-coded Password), CWE-22 (Path Traversal), CWE-544 (Missing Error Handling), CWE-200 (Information Exposure), CWE-552 (Unsafe File Access)
## Affected Systems
- **Products:**
- SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00)
- SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00)
- **Versions:**
- **CC712:** All versions >= V2.0 and < V2.1
- **CC716:** All versions < V2.1 (Specifically affected by CVE-2023-29103 and CVE-2023-29105)
- **Configurations:** Systems utilizing Web Based Management (WBM), REST APIs, or MQTT broker communications.
## Vulnerability Description
SIMATIC Cloud Connect 7 devices suffer from several security flaws:
1. **Command Injection:** Improper input validation in the WBM allows authenticated privileged users to execute code as root (CVE-2023-28832).
2. **Hard-coded Credentials:** Diagnostic files are protected by a hard-coded password, allowing authenticated users to access sensitive data (CVE-2023-29103).
3. **Path Traversal/File Manipulation:** Failure to restrict filenames in the upload feature allows privileged users to read/write files outside intended directories (CVE-2023-29104, CVE-2023-29128).
4. **Insecure API Endpoints:** The REST API export endpoint is unauthenticated, allowing arbitrary file downloads and disclosure of undocumented files (CVE-2023-29106, CVE-2023-29107).
5. **Denial of Service:** The device may crash when parsing malformed (non-JSON) MQTT payloads from a broker (CVE-2023-29105).
## Exploitation
- **Status:** PoC available (indicated by CVSS "Exploitation" subscore E:P). Not currently reported as exploited in the wild.
- **Complexity:** Low (for most); Medium (for MQTT-based DoS).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Root access, sensitive diagnostic/system file disclosure).
- **Integrity:** High (Root-level code execution, file overwriting).
- **Availability:** High (Device-level Denial of Service).
## Remediation
### Patches
Siemens recommends updating to **V2.1 or later versions** for all affected hardware:
- **CC712 & CC716 Firmware:** Available via the Siemens Support portal at hxxps://support[.]industry[.]siemens[.]com/cs/ww/en/view/109818318/
### Workarounds
- Protect network access to devices using firewalls or VLANs.
- Isolate the Industrial Control System (ICS) network from the internet.
- Follow Siemens' operational guidelines for Industrial Security.
## Detection
- **Indicators of Compromise:** Monitor for unusual REST API requests to export endpoints, unauthorized WBM login attempts, or unexpected reboots/crashes following MQTT traffic.
- **Detection methods:** Inspect network traffic for Path Traversal sequences (e.g., `../`) in file upload/download requests and auditing system logs for root-level command execution.
## References
- **Siemens Advisory:** hxxps://cert-portal[.]siemens[.]com/productcert/pdf/ssa-555292[.]pdf
- **Siemens Industrial Security Guidelines:** hxxps://www[.]siemens[.]com/cert/operational-guidelines-industrial-security