A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V16 Update 4), SIMATIC WinCC Runtime Advanced (All versions < V16 Update 4). SmartVNC has an out-of-bounds memory access vulnerability that could be triggered on the client side when sending data from the server, which could result in a Denial-of-Service condition.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-25661
• https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12