Siemens SINEMA Remote Connect (Update A)

Risk Summary

Successful exploitation of these vulnerabilities could allow an attacker to circumvent the system authorization for certain functionalities, and to execute privileged functions.

CVEs (5)

Remediations

• Turn off NTLM authentication to mitigate CVE-2018-16890 and CVE-2019-3822
• Turn off SMTP to mitigate CVE-2019-3823
• Update to V2.0 HF1 - Download: https://support.industry.siemens.com/cs/de/en/view/109764829/
• As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
• Update to V2.0 - Download: https://support.industry.siemens.com/cs/de/en/view/109764829/

Affected Vendors

Affected Products (2)

Affected Sectors

Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater