CVE-2022-38465

CVSS V2 None CVSS V3 High 7.8
Description
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication.
Overview
  • CVE ID
  • CVE-2022-38465
  • Assigner
  • productcert@siemens.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2022-10-11T11:15:10
  • Last Modified Date
  • 2023-02-14T11:15:13
Weakness Enumerations
CWE URL
CWE-522 http://cwe.mitre.org/data/definitions/522.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:siemens:simatic_et_200_sp_open_controller_cpu_1515sp_pc2_firmware:*:*:*:*:*:*:*:* 1 OR 21.9
cpe:2.3:h:siemens:simatic_et_200_open_controller_cpu_1515sp_pc2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_et_200_sp_open_controller_cpu_1515sp_pc_firmware:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:siemens:simatic_et_200_open_controller_cpu_1515sp_pc:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_drive_controller_cpu_1504d_tf_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_drive_controller_cpu_1504d_tf:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_drive_controller_cpu_1507d_tf_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_drive_controller_cpu_1507d_tf:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1211c_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1211c:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1212c_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1212c:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1212fc_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1212fc:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1214fc_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1214fc:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1214c_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1214c:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1215fc_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1215fc:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1215c_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1215c:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1200_cpu_12_1217c_firmware:*:*:*:*:*:*:*:* 1 OR 4.5.0
cpe:2.3:h:siemens:simatic_s7-1200_cpu_12_1217c:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1510sp-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1510sp-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1510sp_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1510sp:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1511-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_151511c-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_151511c-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_151511f-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_151511f-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511t-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1511t-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1511tf-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1511tf-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1512c-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1512c-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1512sp-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1512sp-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1512spf-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1512spf-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1513-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1513-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1513f-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1513f-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1513r-1_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1513r-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_15prof-2_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_15prof-2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_15pro-2_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_15pro-2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1515-2_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1515-2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1515f-2_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1515f-2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1515r-2_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1515r-2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1515t-2_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1515t-2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516pro_f_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516pro_f:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516-3_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516-3:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516f-3_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516f-3:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516t-3_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516t-3:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1516tf-3_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1516tf-3:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1517-3_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1517-3:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1517f-3_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1517f-3:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518hf-4_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518hf-4:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518t-4_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518t-4:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518tf-4_firmware:*:*:*:*:*:*:*:* 1 OR 2.9.2
cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518tf-4:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:a:siemens:simatic_s7-1500_software_controller:*:*:*:*:*:*:*:* 1 OR 21.9
AND
cpe:2.3:o:siemens:simatic_s7-plcsim_advanced_firmware:*:*:*:*:*:*:*:* 1 OR 4.0
cpe:2.3:h:siemens:simatic_s7-plcsim_advanced:-:*:*:*:*:*:*:* 0 OR
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 7.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 1.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://cert-portal.siemens.com/productcert/pdf/ssa-568427.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-568428.pdf
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-38465
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38465
History
Created Old Value New Value Data Type Notes
2022-10-11 12:00:10 Added to TrackCVE
2022-12-07 06:02:42 2022-10-11T11:15Z 2022-10-11T11:15:10 CVE Published Date updated
2022-12-07 06:02:42 2022-11-08T11:15:10 CVE Modified Date updated
2022-12-07 06:02:42 Modified Vulnerability Status updated
2022-12-07 06:02:51 References updated
2023-02-14 13:13:17 2023-02-14T11:15:13 CVE Modified Date updated
2023-02-14 13:13:18 A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions), SINUMERIK ONE (All versions). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication. A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication. Description updated