CVE-2023-43504
📋 TL;DR
A buffer overflow vulnerability in COMOS's Ptmcast executable allows attackers to execute arbitrary code or cause denial of service. This affects all COMOS versions before V10.4.4. Attackers could potentially gain full control of affected systems.
💻 Affected Systems
- Siemens COMOS
📦 What is this software?
Comos by Siemens
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Denial of service affecting COMOS functionality, potentially disrupting industrial operations.
If Mitigated
Limited impact if network segmentation and access controls prevent exploitation attempts.
🎯 Exploit Status
SEH-based buffer overflow requires specific knowledge of COMOS memory layout but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V10.4.4 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-137900.pdf
Restart Required: Yes
Instructions:
1. Download COMOS V10.4.4 or later from Siemens support portal. 2. Backup current installation. 3. Run installer with administrative privileges. 4. Restart affected systems.
🔧 Temporary Workarounds
Disable Ptmcast Service
windowsStop and disable the vulnerable Ptmcast executable if not required for operations.
sc stop Ptmcast
sc config Ptmcast start= disabled
Restrict Network Access
windowsBlock network access to COMOS services using firewall rules.
netsh advfirewall firewall add rule name="Block COMOS" dir=in action=block program="C:\Program Files\Siemens\COMOS\Ptmcast.exe" enable=yes
🧯 If You Can't Patch
- Implement strict network segmentation to isolate COMOS systems from untrusted networks.
- Apply Windows security hardening and disable unnecessary services.
🔍 How to Verify
Check if Vulnerable:
Check COMOS version in About dialog or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\COMOS\VersionCheck Version:
reg query "HKLM\SOFTWARE\Siemens\COMOS" /v VersionVerify Fix Applied:
Verify version is V10.4.4 or later and Ptmcast executable is updated.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Ptmcast.exe
- Access violations or crash logs related to Ptmcast
Network Indicators:
- Unexpected network connections to COMOS service ports
- Traffic patterns indicating buffer overflow attempts
SIEM Query:
ProcessName="Ptmcast.exe" AND (EventID=1000 OR EventID=1001)