Critical vulnerabilities in Siemens PLC devices could allow bypass of protected boot features (CVE-2022-38773)

Red Balloon Security disclosed multiple, critical architectural vulnerabilities in the Siemens SIMATIC and SIPLUS S7-1500 Series PLC that allow for bypass of all protected boot features. These vulnerabilities affect over 120 different models of the Siemens S7-1500 CPU product family.

The vulnerable implementation of RoT using a secure cryptographic processor. If the shared cryptographic material is captured, adversaries may use the secure cryptographic processor as an oracle to encrypt and decrypt tampered firmware.

Red Balloon has reported these vulnerabilities to Siemens, and Siemens has confirmed them. CVE-2022-38773 has been assigned, and a CVSS v3 score of 4.6 was assessed.

Implications and exploitation

This discovery has significant implications for industrial environments as it pertains to hardware root-of-trust vulnerabilities that cannot be patched.

Exploitation of these vulnerabilities could allow offline attackers to generate arbitrary encrypted firmware that are bootable on all Siemens S7-1500 series PLC CPU modules. Furthermore, these vulnerabilities allow attackers to persistently bypass integrity validation and security features of the ADONIS operating system and subsequent user space code.

“It’s important for all industrial operators using the Siemens S7-1500 Series PLC to take several steps to prevent possible exploitation of these critical vulnerabilities,” said Dr. Ang Cui, CEO of Red Balloon. “While these vulnerabilities technically require physical access to exploit, it is possible for sophisticated attackers to ‘chain,’ or combine, these vulnerabilities with other remote access vulnerabilities on the same network to install malicious firmware without the need for in-person contact.”

“The vulnerabilities exist because the Siemens custom System-on-Chip (SoC) does not establish a tamper proof Root of Trust (RoT) in the early boot process,” said Yuanzhe Wu, senior research scientist at Red Balloon. “The Siemens RoT is implemented through the integration of a dedicated cryptographic secure element – the ATECC CryptoAuthentication chip. However, this RoT implementation contains flaws that can be abused by attackers to compromise RoT itself and allow attackers to decrypt and load tampered firmware on the S7-1500 PLCs without user’s knowledge.”

Although there are possible ways to mitigate the effects of this hardware RoT exploitation such as using run-time memory attestation, the fundamental vulnerabilities – improper hardware implementations of the RoT using dedicated cryptographic-processor – are unpatchable and cannot be fixed by a firmware update since the hardware is physically unmodifiable.

CVE-2022-38773: Recommendations

Siemens recommends that customers assess the risk of physical access to the device in the target deployment and to implement measures to make sure that only trusted personnel have access to the physical hardware.

To limit the effects of potential exploitation of these vulnerabilities, Red Balloon has recommended several mitigations to Siemens, which include: implement runtime integrity attestation; add asymmetric signature check for firmware at bootup scheme; and encrypt the firmware with device specific keys that are generated on individual devices.

Affected devices

• SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0)
• SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0)
• SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0)
• SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0)
• SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0)
• SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0)
• SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0)
• SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0)
• SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0)
• SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0)
• SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0)
• SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0)
• SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0)
• SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0)
• SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0)
• SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0)
• SIMATIC S7-1500 CPU 1512SP F-1PN (6ES7512-1SK00-0AB0)
• SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0)
• SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK00-0AB0)
• SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK01-0AB0)
• SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0)
• SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0)
• SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0)
• SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0)
• SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0)
• SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0)
• SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RL00-0AB0)
• SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0)
• SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0)
• SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0)
• SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0)
• SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0)
• SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0)
• SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RM00-0AB0)
• SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0)
• SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0)
• SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0)
• SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0)
• SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0)
• SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0)
• SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0)
• SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0)
• SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3TN00-0AB0)
• SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3UN00-0AB0)
• SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0)
• SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3FP00-0AB0)
• SIMATIC S7-1500 CPU 1517H-3 PN (6ES7517-3HP00-0AB0)
• SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0)
• SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0)
• SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0)
• SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
• SIMATIC S7-1500 CPU 1518-4F PN/DP (6ES7518-4FP00-0AB0)
• SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
• SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JP00-0AB0)
• SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0)
• SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0)
• SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0)
• SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0)
• SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0)
• SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0)
• SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0)
• SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0)
• SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0)
• SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0)
• SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0)
• SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0)
• SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0)
• SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0)
• SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0)
• SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0)
• SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0)
• SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0)
• SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0)
• SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0)
• SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0)
• SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0)
• SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0)
• SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0)
• SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0)
• SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0)
• SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0)
• SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0)
• SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0)
• SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0)
• SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0)
• SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0)
• SIPLUS S7-1500 CPU 1515R-2 PN (6AG1515-2RM00-7AB0)
• SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL (6AG2515-2RM00-4AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0)
• SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0)
• SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0)
• SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0)
• SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0)
• SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0)
• SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0)
• SIPLUS S7-1500 CPU 1517H-3 PN (6AG1517-3HP00-4AB0)
• SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0)
• SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
• SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0)