OTORIO, a leading industrial cybersecurity solutions provider, today announced that its researchers have recently discovered a vulnerability in a series of Siemens industrial devices. The vulnerability [CVE-2019-13946] is a DOS (denial of service) Uncontrolled Resource Consumption vulnerability. If exploited, it can be used by hackers to cause an affected device to shut down. Worse still, in some cases, the vulnerability can cause a device to be halted - requiring a hard restart.
The vulnerability discovered by OTORIO lays inside the implementation of the Profinet(R) stack in Siemens devices including distributed I/Os (SIMATIC ET200), communication modules (SIMATIC CP) and industrial switches (SCALANCE).
These devices are used among other things, to connect dispersed IoT devices with core systems, networks and processes and serve critical infrastructure in verticals ranging from power generation and distribution, Oil & Gas, Transportation, and more. Failing to patch the vulnerability could have hazardous consequences including power outages, failure of traffic control systems, disrupted operations and more.
“The vulnerability we exposed can be easily exploited. Coupled with the high-sensitivity of the services running over Siemens devices, it arms the flaw with a huge potential for damage,” said Yuval Ardon, Security Researcher at OTORIO. “It is a remote, routable and unauthenticated vulnerability that uses legitimate functionality of the protocol. This complicates mitigation because blocking Profinet communication can cause a disruption in the operational process of machinery, signaling networks and connected devices.”
Siemens has developed a patch to address the vulnerability. Users are advised to follow Siemens instructions and to confirm their systems have been updated to the latest security patch.
About OTORIO
OTORIO is an industrial-native cyber and digital risk-management solutions provider. OTORIO’s automated Digital Risk-based Maintenance solution aggregates threat data analysis to provide deep insights into industrial control systems, identifying risks, and mitigating them before they can cause damage. OTORIO empowers industrial companies to implement, automate, and operate secure production, making way for a safer, more reliable, and productive industry.