Siemens SINUMERIK VNC authentication bypass on adjacent network
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authentication bypass in Siemens SINUMERIK VNC service allows adjacent network attackers unauthorized access; no active exploitation reported.
Siemens SINUMERIK industrial control systems contain an authentication bypass vulnerability in the VNC access service that improperly validates credentials, allowing attackers on an adjacent network to gain unauthorized remote access with low attack complexity. The vulnerability affects multiple SINUMERIK product lines including 828D PPU, 840D sl, MC, and ONE series across multiple versions. Successful exploitation could compromise confidentiality, integrity, or availability of affected systems. CISA reports no known public exploitation as of the advisory date, and the vulnerability is not remotely exploitable—requiring adjacent network access. Siemens has released patches for all affected product versions and recommends immediate updating along with network segmentation and VNC port closure via HMI settings.
Mentioned in this report
Detection guidance
Non-VNC-Client Process Connecting to VNC Port on Internal Host
Detects a process that is not a known VNC client opening an outbound connection to a VNC port (5900-5903) on an internal address. This can indicate scripted or exploit-driven access to adjacent VNC services such as the SINUMERIK HMI VNC authentication bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-VNC-Client Process Connecting to VNC Port on Internal Host
description: Detects a process that is not a known VNC client opening an outbound
connection to a VNC port (5900-5903) on an RFC1918 address. Can indicate scripted
or exploit-driven access to adjacent VNC services such as the SINUMERIK HMI VNC
authentication bypass. The report is an advisory with no public exploitation, so
this is a hunting-grade network behaviour rule.
tags:
- attack.initial-access
- attack.persistence
- attack.t1133
- attack.t1078
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort:
- 5900
- 5901
- 5902
- 5903
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
filter_vnc_clients:
Image|endswith:
- \vncviewer.exe
- \tvnviewer.exe
- \vncviewer64.exe
- \VNC-Viewer.exe
- \ultravnc_viewer.exe
condition: selection and not filter_vnc_clients
falsepositives:
- Engineering workstations using a less common or portable VNC client to reach HMI
or PLC panels
- Network or asset scanners probing VNC ports during authorised vulnerability assessments
level: medium
id: ce12b80b-83ac-5e57-a2d8-e61c0029920d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-19
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-19
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs