Siemens PLC Software: Hardcoded Cryptographic Keys Uncovered

Team82 disclosed a critical vulnerability chain allowing extraction of global hardcoded private keys from Siemens SIMATIC S7-1200/1500 PLCs by using an RCE to read protected memory; with the recovered keys an attacker can decrypt configurations and traffic, recover passwords, perform man-in-the-middle and passive decryption attacks, and gain full control of affected PLC families (CVE-2022-38465, CVSS 9.3). Siemens released firmware and TIA Portal updates (introducing a PKI/TLS-based system) to mitigate the issue.