Siemens patches Heartbleed in popular SCADA system

Some of the company's other products are still vulnerable

Siemens released a security update to address the Heartbleed vulnerability in SIMATIC WinCC Open Architecture, a supervisory control and data acquisition (SCADA) system that's used in a large number of industries to operate processes, machines and production flows.

Heartbleed is a critical security flaw discovered earlier this month in OpenSSL, the most popular implementation of the TLS (Transport Layer Security) and SSL (Secure Sockets Layer) protocols.

The vulnerability can be exploited to extract passwords, encryption keys and other potentially sensitive information from the memory of TLS servers and clients that rely on OpenSSL for encrypted communications. While most of the discussion surrounding the vulnerability has focused on how it impacts Web servers, the flaw also affects desktop and mobile applications, embedded systems like routers, hardware appliances and industrial control systems, including those potentially used in critical infrastructure.

Siemens updated its Heartbleed security advisory Friday to announce the availability of WinCC OA version 3.12-P006 that fixes the flaw for WinCC OA 3.12, the only affected version of the product according to the company.

However, Heartbleed also affects other Siemens products: eLAN prior to version 8.3.3 when RIP is used, S7-1500 V1.5 when HTTPS is active, CP1543-1 V1.1 when FTPS is active and APE 2.0 when the SSL/TLS component is used in customer implementations.

ELAN customers can solve the security issue by updating to version 8.3.3, but the other affected products are yet to receive patches. In the meantime, Siemens suggests several mitigations in its security advisory that involve disabling or restricting access to the web server in S7-1500 and disabling or restricting access to FTPS in CP1543-1.

APE 2.0 customers can upgrade the OpenSSL installation in the product to version 1.0.1g by following instructions in a separate advisory published on the RuggedCom website. RuggedCom is a subsidiary of Siemens and the original maker of the product.

Read more: Centrify makes big strides

Join the PC World newsletter!

Error: Please check your email address.

Tags patchessiemenssecuritypatch managementExploits / vulnerabilities

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Deals on PC World

Deals on PC World

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?