Headline
CVE-2021-27385
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V15.1 Update 6), SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced V15 (All versions < V15.1 Update 6), SIMATIC WinCC Runtime Advanced V16 (All versions < V16 Update 4), SINAMICS GH150 (All versions), SINAMICS GL150 (with option X30) (All versions), SINAMICS GM150 (with option X30) (All versions), SINAMICS SH150 (All versions), SINAMICS SL150 (All versions), SINAMICS SM120 (All versions), SINAMICS SM150 (All versions), SINAMICS SM150i (All versions). A remote attacker could send specially crafted packets to SmartVNC device layout handler on client side, which could influence the amount of resources consumed and result in a Denial-of-Service (infinite loop) condition.
%PDF-1.5 %���� 1 0 obj << /D [2 0 R /XYZ 70.866 771.024 null] >> endobj 3 0 obj << /D [2 0 R /XYZ 70.866 630.026 null] >> endobj 4 0 obj << /D [2 0 R /XYZ 70.866 581.902 null] >> endobj 5 0 obj << /D [6 0 R /XYZ 70.866 707.065 null] >> endobj 7 0 obj << /D [6 0 R /XYZ 70.866 636.027 null] >> endobj 8 0 obj << /D [9 0 R /XYZ 85.039 148.658 null] >> endobj 10 0 obj << /D [11 0 R /XYZ 70.866 624.665 null] >> endobj 12 0 obj << /S /GoTo /D [2 0 R /Fit] >> endobj 2 0 obj << /Contents 13 0 R /Type /Page /Resources 14 0 R /Parent 15 0 R /Annots [16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R] /MediaBox [0 0 595.276 841.89] >> endobj 16 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109763890/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 458.519 518.276 469.936] >> endobj 18 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109775861/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 392.569 518.276 403.986] >> endobj 20 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109763890/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 326.618 518.276 338.035] >> endobj 22 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109775861/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 260.667 518.276 272.084] >> endobj 24 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109763890/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 194.717 518.276 206.134] >> endobj 26 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109775861/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 128.766 518.276 140.183] >> endobj 28 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109763890/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 86.726 518.276 98.143] >> endobj 30 0 obj << /A << /S /URI /Type /Action /URI (https://support.industry.siemens.com/cs/ww/en/view/109776018/) >> /C [0 1 1] /Subtype /Link /Type /Annot /H /I /Border [0 0 0] /Rect [303.117 732.465 518.276 743.882] >> endobj 14 0 obj << /ProcSet [/PDF /Text] /Font << /F52 31 0 R /F49 32 0 R >> >> endobj 13 0 obj << /Filter /FlateDecode /Length 2324 >> stream x��Z[s۸~����C�D�L_�N�z’�%����E�Ne�+Qv����f�"�T)�����s�w>����’;�it48�&1�H*��M�0�R&�$�JF��t�g��|��S��a6Y/{}"Ҽ��wO���:NC}lW�_,���8�tكѣ�o���>��~?"�Nȓ)F����/��d �~N0bF’n�m�C�3hϒ��?�p0*�VdZ�k�M���(�(��GЄ0d�Re ����A��`Z)��i�fqb�q�Őª�i��f�V�k!~����I��)2�� A�� FP����Q�z�V���j�uO�t=�g��|�y�j�¸F<��X�i �U1ne �H����(����7h������*a��l�� ���.����q���>ېE����E���[Y�l�����hm+���l�|~r���0�mۄ0R��V�Q����b�CG��u<�!5N�T �x��v�;�’�"_�=�~��e�iJ1%},��X�v:8�@8����U��\�M�,����i��z���a�uO�4[�`u�͉&�5�q����O�g���O�U �d�� ()R������"��Ki�7��.ڔB!�4�������’p�o�x��N�b%!�Z��[�|������B������AT��� ����� (~d�c|sc�d6)���[�qg�*���l���>���b=s�3�F�7��vQ�&�i�3�1��ׯ�v d�V+�C�(;;��iH�l��g��M�yp�OB(�E1�ؼ�O�������I<3�C�N�in_Y}���6��!4�$c�O�B��G� �e6� �����k���Ս5��� Cjކ���a�7X[N���4�(�5�}A:Kgv��w���;=�݂+$�V$42���n!0p�qǧ��NF�>n�*�U�Y���T`K�JyI�d��V5�/.m:}�xu2n��0D�� F��6"(GH�6@�T��/|O)��8�̩�&q�ߦ�ƅ�*>���jt��ˆ�%P�i"������� k��l�O2����60�����’�?�,�’����y�S^��Sj�>���YrS:�D��Z�i$�DPiCj���2-�q��([HD�r���)�����A�F�ɮa�x�G.ާ�8�����T����f��:�[�v�����z� �#�˛�BP@��T�d2�+J�%���!��e��q��uEpJ����.�W/��/��l����D��z��R� b�’k��)@�;�¿b���d��;��|�����p�0�+K���1(�s���i��1¢�7�g��T_y!�k�LDD"z�8�e��o�\{��g�� *�*qLb�������״���1��u�a� �8YV]-\2W�\��=� �:��X����;�#a�¿�N�� ��)�+�p2X`�X����&��*�’�(��Շ�`���swS&-P>��W�Md���3:E�@ O���d5xxd�AM5 �������癅��FA&[“R�- ����!UW�TL[f�w�bV�:P�6@eB@2�y�J6a��S� Wc˕�5L��):�P�6Q�>@�LwhD)��C ;�Z0� R�@�H)q?>�;}�fɳ�}O`T&��%�z ۈT|K�����Y���:�@�u����PǴ�snB�Z�P�s�5P�)�[J;!]W�8]�}흀tLZ�”](��`�t �����2��g���<��w��#���('�J��Pc��⍟<<�s|�X9@o���M�Wg`���rwƨ�’���Q�v��g`�gKSf;�{�:�\��OYd߸D�q����%�.Q-�(�Aq���k�щ[��7`\T+��oø����7`\T|�CBi,:0��S�KP�_�@[W�&ZSD��|�d5lctE�(��KO�*����7��r��