Version Step 7 V4 SP9 is the latest version for programming PLC S7-200 This version supports all s7-200 series including the lines of china: ( Siemens CPU22CN, CPU224CN, CPU226CN ) It also supports installation on win 10 64bit Installation video tutorial (Download link at the end of the article): Installation instructions for images. Siemens has wide range of PLCs. Not all Siemens PLCs are supported by a single software. I have listed below the software and the PLCs it supports. Micro Win. S7 200 Series Micro Win Smart. S7 200 Smart Series Simatic Manager - Step 7. S7 300 S. View and Download Siemens SIMATIC S7-300 manual online. High-speed analog mixed module. SIMATIC S7-300 I/O Systems pdf manual download. Also for: Sm 335. Automation Technology Industrial Communication Industrial Ethernet System interfaces SIMATIC S7 Communication for SIMATIC S7-300 CP 343-1 Lean; Automation Technology Industrial Communication Industrial Ethernet System interfaces SIMATIC S7 Communication for SIMATIC S7-300 CP 343-1.
1. EXECUTIVE SUMMARY
2. RISK EVALUATION
Successful exploitation of this vulnerability could crash the device being accessed, resulting in a denial-of-service condition.
3. TECHNICAL DETAILS3.1 AFFECTED PRODUCTS
Siemens reports the following SIMATIC S7-300 CPU product is affected:
3.2 VULNERABILITY OVERVIEW
3.2.1 IMPROPER INPUT VALIDATION CWE-20
The affected CPUs improperly validate S7 communication packets, which could cause a denial-of-service condition of the CPU. The CPU will remain in DEFECT mode until manual restart.
Successful exploitation requires an attacker to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). The vulnerability could allow a denial-of-service condition of the core functionality of the CPU. CVE-2018-16561 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). 3.3 BACKGROUND
3.4 RESEARCHER
China Industrial Control Systems Cyber Emergency Response Team (CIC) reported this vulnerability to Siemens.
4. MITIGATIONS
Siemens recommends users update to Version 3.X.16, which can be downloaded from the following link:
https://support.industry.siemens.com/cs/ww/en/ps/13752/dl Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security (https://www.siemens.com/cert/operational-guidelines-industrial-security), and following the recommendations in the product manuals.
Additional information on industrial security by Siemens can be found at: https://www.siemens.com/industrialsecurity
For more information on this vulnerability and associated software updates, please see Siemens security advisory SSA-306710 on their website:
https://www.siemens.com/cert/advisories
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents. Siemens Software Downloads
No known public exploits specifically target this vulnerability.
Siemens Simatic S7-300 Software
|
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |