Security researcher who discovered CVE-2022-43513 and CVE-2022-43514 in Automation License Manager (ALM) explained that most of Siemens’ software products use the ALM by default for license management. This means the vulnerabilities impact organizations that use one of many Siemens products, including the Simatic PCS 7 historian, the Sicam Device Manager, WinCC, TIA Portal, and the DIGSI engineering tool.
According the researcher, access to a server in the corporate network (e.g., Simatic PCS 7 historian which has a repository for industrial process data) can be used as a bridge to laterally move across other machines in corporate network and further into operational technology (OT) network containing engineering, control systems, and monitoring systems. Operational technology (OT) refers to computing systems that are used to manage industrial operations. Industrial control systems (ICS) are a major subset within the OT sector.
Siemens has released an update that should fix the flaws in ALM 6, but the company currently does not plan on releasing a patch for version 5. Workarounds and mitigations are also available.
Comments