Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.

To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and to follow the recommendations in the product manuals.įor more information, see Siemens security advisory SSA-930100 in HTML or CSAF.ĬISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Remove write permissions for non-administrative users on files and folders located under the installation path.Īs a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms.

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

CRITICAL INFRASTRUCTURE SECTORS: Critical ManufacturingĬraig Carr, from University of Glasgow, reported this vulnerability to Siemens.

A CVSS v3 base score of 7.8 has been calculated the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain elevated privileges.ĬVE-2022-43517 has been assigned to this vulnerability. The affected application improperly assigns file permissions to installation folders. The following versions of Siemens Simcenter STAR-CCM+, a computational fluid dynamics software, are affected:ģ.2.1 INCORRECT PERMISSION ASSIGNMENT FOR CRITICAL RESOURCE CWE-732 Successful exploitation of this vulnerability could allow a local attacker with an unprivileged account to override or modify the service executable and subsequently gain elevated privileges.

Vulnerability: Incorrect Permission Assignment for Critical Resource.

Simcenter starccm+