CVE-2021-27386

Q: How do I fix CVE-2021-27386?

1. Download appropriate update from Siemens Industrial Security. 2. Apply update following Siemens documentation. 3. Restart affected devices. 4. Verify version matches patched release.

Q: What is the severity of CVE-2021-27386?

CVE-2021-27386 has a CVSS score of 7.5 (HIGH). This vulnerability is a heap allocation leak in the SmartVNC device layout handler on client-side devices, which could lead to Denial-of-Service conditions. It affects multiple Siemens industrial HMI panels, WinCC Runtime systems, and SINAMICS drives. Attackers could exploit this to crash affected devices, disrupting industrial operations.

7.5 HIGH

Denial of Service

📋 TL;DR

This vulnerability is a heap allocation leak in the SmartVNC device layout handler on client-side devices, which could lead to Denial-of-Service conditions. It affects multiple Siemens industrial HMI panels, WinCC Runtime systems, and SINAMICS drives. Attackers could exploit this to crash affected devices, disrupting industrial operations.

💻 Affected Systems

Products:

SIMATIC HMI Comfort Outdoor Panels V15 7" & 15"
SIMATIC HMI Comfort Outdoor Panels V16 7" & 15"
SIMATIC HMI Comfort Panels V15 4" - 22"
SIMATIC HMI Comfort Panels V16 4" - 22"
SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900, KTP900F
SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900, KTP900F
SIMATIC WinCC Runtime Advanced V15
SIMATIC WinCC Runtime Advanced V16
SINAMICS GH150
SINAMICS GL150 (with option X30)
SINAMICS GM150 (with option X30)
SINAMICS SH150
SINAMICS SL150
SINAMICS SM120
SINAMICS SM150
SINAMICS SM150i

Versions: V15 versions < V15.1 Update 6, V16 versions < V16 Update 4, SINAMICS drives: All versions

Operating Systems: Embedded industrial OS on Siemens devices

Default Config Vulnerable: ⚠️ Yes

Notes: SIPLUS variants are also affected. SINAMICS GL150 and GM150 only vulnerable with option X30 installed.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device crash leading to operational disruption in industrial environments, potentially affecting safety-critical systems or production lines.

🟠

Likely Case

Service interruption on affected HMI panels or drives requiring manual restart, causing temporary production downtime.

🟢

If Mitigated

Minimal impact if devices are isolated from untrusted networks and regularly monitored for abnormal behavior.

🌐 Internet-Facing: MEDIUM - Devices exposed to internet could be targeted for DoS attacks, but exploitation requires specific conditions.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this to disrupt operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires network access to vulnerable SmartVNC service. No public exploits known as of advisory publication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: V15.1 Update 6 for V15 products, V16 Update 4 for V16 products

Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf

Restart Required: Yes

Instructions:

1. Download appropriate update from Siemens Industrial Security. 2. Apply update following Siemens documentation. 3. Restart affected devices. 4. Verify version matches patched release.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate affected devices in separate network segments with strict firewall rules limiting access to SmartVNC services.

Disable Unused Services

all

Disable SmartVNC service if not required for operations.

🧯 If You Can't Patch

Implement strict network access controls to limit connections to affected devices
Monitor device memory usage and restart devices showing abnormal memory consumption

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against affected versions list. For SINAMICS drives, verify if option X30 is installed.

Check Version:

Check version via Siemens HMI device interface or TIA Portal project properties.

Verify Fix Applied:

Confirm device firmware version is V15.1 Update 6 or higher for V15 products, or V16 Update 4 or higher for V16 products.

📡 Detection & Monitoring

Log Indicators:

Unexpected device restarts
Memory exhaustion warnings
SmartVNC service crashes

Network Indicators:

Multiple connection attempts to SmartVNC ports (typically 5900+)
Abnormal traffic patterns to industrial devices

SIEM Query:

source="industrial_devices" AND (event_type="crash" OR memory_usage>90%) AND process="SmartVNC"

📊 Metadata

CVE ID: CVE-2021-27386

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-401

Published: May 12, 2021

Last Updated: November 21, 2024

🔗 References

https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12 Third Party Advisory,US Government Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12 Third Party Advisory,US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 15\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Outdoor Panels 7\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 22\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Comfort Panels 4\" Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp400f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700 Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700f Firmware by Siemens

Simatic Hmi Ktp Mobile Panels Ktp700f Firmware by Siemens