• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – Adobe Releases Patches for 25 Security Vulnerabilities
December 11, 2019
Rewterz Threat Alert – Office 365 App Phishing Campaign
December 12, 2019

Rewterz Threat Advisory – Siemens SCALANCE W700 and W1700 Information Exposure Vulnerability

December 11, 2019

Severity

Medium

Analysis Summary

An improper enforcement of message integrity during transmission in a communication channel vulnerability is found in the Siemens SCALANCE W700 and W1700 wireless communication devices.

Under certain conditions, the integrity of EAPOL-key messages might not be checked, leading to a decryption oracle. This could be exploited by an attacker within range of the access point, which could allow the abuse of the vulnerability to access confidential data. CVE-2018-14526 has been assigned to this vulnerability.

Impact

Exposure of sensitive information

Affected Vendors

Siemens

Affected Products

  • SCALANCE W700 Versions 6.3 and prior
  • SCALANCE W1700 Versions 1.0 and prior

Remediation

Apply the following updates:

  • SCALANCE W700: Update to v6.4 or later
  • SCALANCE W1700: Update to v1.1 or later

    Additionally:
  • Whenever possible, use AES-CCMP instead of TKIP in the WPA/WPA2 networks. This can be configured for both the SCALANCE W-700 and W-1700 families over the Web Based Management (web server). 
  • Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls, and isolate them from the business network.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.