Plan ahead Medium Patch available
Siemens advisory covers many process control and historian products
Canadian Centre for Cyber SecuritySiemens, Mendix, ROS# · manufacturing
What happened. The Canadian Centre for Cyber Security reports Siemens vulnerabilities in many products, including SIMATIC PCS 7, WinCC, Process Historian and BATCH, Mendix Studio Pro, ROS#, RUGGEDCOM APE1808 and Simcenter Femap. It urges users to apply updates as they become available.
Who is affected. Users of Siemens SIMATIC PCS 7 V9.1, SIMATIC WinCC, SIMATIC Process Historian, SIMATIC BATCH, Mendix Studio Pro, ROS#, RUGGEDCOM APE1808 and Simcenter Femap, in the versions listed.
What to do. Check whether you run the listed Siemens products and versions, review the Siemens advisory, and apply updates as they become available.
When to act. Plan ahead: Siemens SIMATIC, WinCC and PCS 7 operators: check the listed versions and apply updates in the normal cycle.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: SIMATIC WinCC and PCS 7 run on SCADA and operator systems (L2), while Process Historian, Information Server and BATCH run on site operations servers (L3).
- Are you exposed?
Search your asset inventory for the listed Siemens products and versions, such as PCS 7 V9.1, WinCC V7.5 to V8.1 and Process Historian 2020 or 2022.
- If you cannot fix it yet
- Restrict network access to SCADA, historian and batch servers to known engineering and operator hosts.
- Keep these servers off direct access from the corporate network and the internet.
- Watch for
- Watch for logons to WinCC, PCS 7 and Process Historian hosts from the IT network or from unfamiliar accounts.
- Look for unexpected new services or connections on the historian and batch servers.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Canadian Centre for Cyber Security (opens cyber.gc.ca)
More on Siemens Manufacturing