“These types of cryptographic keys are intended to remain secret, and can be utilized for data encryption, integrity protection and identity verification.” “This new knowledge allowed us to implement the full protocol stack, encrypt and decrypt protected communication, and configurations.”Īccording to Saeed Abbasi, Manager of Vulnerability Signatures at Qualys, hardcoded encryption keys are prone to disclosure, thus undermining the system’s security. Previous vulnerability in Siemens devices leveragedĬlaroty extracted the private encryption keys by leveraging a previous vulnerability, CVE-2020-15782, to bypass native memory protections, gain read and write privileges in protected areas and perform remote code execution. “In addition, an attacker can develop an independent Siemens SIMATIC client (without requiring the TIA Portal) and perform full upload/download procedures, conduct man-in-the-middle attacks, and intercept and decrypt passive OMS+ network traffic,” the researchers said.Ĭlaroty had discovered a similar authentication bypass vulnerability CVE-2021-22681 in Rockwell Automation PLCs, allowing a remote attacker to upload code, download data from industrial devices, and potentially install new firmware. This exploit could grant them persistence and control of industrial devices for follow-on attacks, including data exfiltration and malware distribution. Similarly, an attacker could create a rogue Siemens SIMATIC client bypassing the TIA portal.

“An attacker can use these keys to perform multiple advanced attacks against Siemens SIMATIC devices and the related TIA Portal, while bypassing all four of its access level protections.” This exploit is invaluable for nation-state attackers interested in cyber warfare against adversaries’ critical infrastructure. A threat actor could leverage hardcoded encryption keys to bypass all protection levels and perform sophisticated attacks on industrial devices.

Siemens hmi software free download