Over 100 Siemens PLC Models Found Vulnerable to Firmware Takeover
12-Jan-23
Multiple architectural flaws in Siemens SIMATIC and SIPLUS S7-1500 programmable logic controllers (PLCs) have been revealed by security researchers. These flaws could be used by a hostile actor to covertly instal firmware on the vulnerable devices and seize control of them. The problems were found by Red Balloon Security and are recorded as CVE-2022-38773 (CVSS score: 4.6).
Because physical interference with the device is necessary for exploitation, the severity is limited. According to the business, the holes “may allow attackers to bypass all protected boot protections, resulting in persistent arbitrary change of operating code and data.” There are more than 100 models that are weak.
