CVE-2023-44487 in siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Affected software: siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp firmware, siemens sinec ins, siemens sinec nms, siemens st7 scadaconnect, siemens ruggedcom ape1808 firmware, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp firmware, siemens siplus s7-1500 cpu 1518-4 pn/dp mfp firmware, ietf http, nghttp2, netty
Scores
- CVSS: 7.5 (high)
- EPSS: 100.00% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2023-10-10
- Published: 2023-10-10
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Patch web servers and proxies for HTTP/2 Rapid Reset (CVE-2023-44487)
Patch or upgrade. Patched HTTP/2 servers limit stream resets so a single client cannot exhaust them; putting a DDoS-protected proxy in front absorbs the rest.
Applies to: HTTP/2 servers and proxies without the October 2023 fixes
- List internet-facing servers and proxies that speak HTTP/2 (nginx, Apache, IIS, HAProxy, Envoy, load balancers).
- Install the vendor updates from October 2023 or later.
- Where a patch is not available, turn off HTTP/2 or set limits on concurrent streams.
- Put public services behind a CDN or DDoS protection service.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.