Researchers discovered an undocumented access feature in Siemens SIMATIC S7-1200 programmable logic controller (PLC) that could be exploited by attackers to execute arbitrary code on affected devices.
The feature was discovered by a team of researchers from the Ruhr-University Bochum in Germany composed of Ali Abbasi, Tobias Scharnowski and Thorsten Holz.
The medium-severity flaw was tracked as CVE-2019-13945 and received a CVSS score of 6.8, the issue is hard to exploit because requires a deep knowledge of the operating system used by the Siemens SIMATIC S7-1200
The Siemens S7 is considered one of the most secure controllers in the industry, it is used in power plants, traffic lights, water pumps, building control, production lines, aviation systems, and many other critical infrastructures.
The researchers focused their analysis on the firmware integrity verification process implemented in the Siemens SIMATIC S7-1200 PLC.
The mechanism is triggered on boot and leverages the
“There is an access mode used during manufacturing of S7-1200 CPUs that allows additional diagnostic functionality. Using this functionality requires physical access to the UART interface during boot process.” reads a security advisory published by Siemens. “Siemens is working on a solution and recommends specific countermeasures until the solution is available “
The access feature was implemented to provide additional diagnostic functionality and it could be accessed by an attacker who has physical access to the device.
The attacker could access the feature by sending a special command via the universal asynchronous receiver-transmitter (UART) interface the boot process, before the PLC firmware is loaded.
The attack could leverage the feature to achieve arbitrary code execution in the boot
The experts have developed a
The experts reported the flaw to Siemens in March and the company confirmed that it is working on a fix.
The advisory published by Siemens includes the following specific
The team of experts will present the results of its research in December at the Black Hat Europe conference in London.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.