SSA-103653: Denial-of-Service-Sicherheitslücke im Automation License Manager

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

• On the Automation License Manager settings menu disable "Allow Remote Connections"
• If remote connections are needed, limit remote access to port 4410/tcp to trusted systems only

Product-specific remediations or mitigations can be found in the sectionAffected Products and Solution.
Please follow theGeneral Security Recommendations.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download:https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at:https://www.siemens.com/industrialsecurity

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.