For awareness Medium Check exposure in your normal cycle
Opening files in Siemens WinCC Graphics Designer can run attacker code
Siemens ProductCERTSiemens, SIMATIC WinCC Graphics Designer
What happened. Siemens reports that Graphics Designer in SIMATIC WinCC before V8.2 runs active content implicitly when a file is opened. An attacker could run arbitrary code on the device. Siemens is preparing fixes and gives mitigations meanwhile.
Who is affected. Users of Siemens SIMATIC WinCC Graphics Designer before V8.2. The report names no sector.
What to do. Check whether you run SIMATIC WinCC before V8.2 and apply the mitigations in Siemens advisory SSA-979641 until fixes are available.
When to act. For awareness: No exploitation stated and fixes are pending; check WinCC Graphics Designer use and apply Siemens mitigations.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L2
Why: WinCC Graphics Designer is engineering software for building HMI screens, so it runs on engineering workstations and SCADA systems at L2.
- Are you exposed?
Search the asset inventory for SIMATIC WinCC installations with Graphics Designer and compare their version with V8.2.
- If you cannot fix it yet
- Open Graphics Designer files only from trusted sources and scan files before use.
- Restrict who can copy project files onto engineering workstations and HMI systems.
- Watch for
- Graphics Designer starting unexpected child processes after a file is opened.
- New project files arriving on engineering workstations from email or removable media.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Siemens ProductCERT (opens cert-portal.siemens.com)
More on Siemens