CVE-2026-13408: Siemens ROS# Remote Code Execution — ICS Defense & Detection

---
title: Siemens ROS# Potential Exploitation - Inbound Network Connection
id: 8a4b2c1d-9e6f-4a3b-8c5d-1e2f3a4b5c6d
status: experimental
description: Detects suspicious inbound connections to the default ROS# Master port (TCP 11311) from non-engineering workstations.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-08
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 11311
    Initiated: 'false'
  filter_legit:
    SourceIp|contains:
      - '10.0.0.'
      - '192.168.1.'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate ROS development stations
level: high
---
title: Siemens ROS# Process Injection - Unusual Child Process
id: 9b5c3d2e-0f7g-5b4c-9d6e-2f3a4b5c6d7e
status: experimental
description: Detects the ROS# process spawning unexpected child processes like cmd or powershell, indicative of successful RCE.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\RosSharp.exe'
      - '\Simatic.Ros.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Administrative troubleshooting
level: critical

// Hunt for inbound connections on ROS# port 11311 from external IPs
let RosPorts = dynamic([11311, 11312, 11313]);
DeviceNetworkEvents
| where RemotePort in (RosPorts)
| where ActionType == "ConnectionAccepted" or ActionType == "InboundConnectionAccepted"
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")) 
   and not(ipv4_is_in_range(RemoteIP, "192.168.0.0/16"))
   and not(ipv4_is_in_range(RemoteIP, "172.16.0.0/12"))
| project Timestamp, DeviceName, RemoteIP, RemotePort, LocalPort, InitiatingProcessAccountName
| order by Timestamp desc

-- Hunt for ROS# process executions and abnormal network listeners
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'RosSharp' OR Name =~ 'Simatic.Ros'

-- Check for listening sockets on ROS ports
SELECT Fd, Family, Address, Port, Process.Pid, Process.Name
FROM listen_sockets()
WHERE Port = 11311

# Check for vulnerable Siemens ROS# versions and block inbound traffic on port 11311
Write-Host "[+] Checking Siemens ROS# Version..."

$rosPath = "C:\Program Files\Siemens\Simatic ROS#\RosSharp.exe"
if (Test-Path $rosPath) {
    $versionInfo = (Get-Item $rosPath).VersionInfo
    $fileVersion = $versionInfo.FileVersion
    Write-Host "[!] Detected ROS# Version: $fileVersion"
    
    # Placeholder logic for version check (Update specific ranges based on vendor advisory)
    if ([version]$fileVersion -lt [version]"3.5.0.0") {
        Write-Host "[!!!] VULNERABLE VERSION DETECTED. Patch immediately to v3.5 or later."
    } else {
        Write-Host "[+] Version appears patched."
    }
} else {
    Write-Host "[-] Siemens ROS# not found in default path."
}

Write-Host "[+] Applying Windows Firewall Restriction on Port 11311..."
try {
    New-NetFirewallRule -DisplayName "Block Inbound ROS# Exploit" -Direction Inbound -LocalPort 11311 -Protocol TCP -Action Block -Enabled True -ErrorAction Stop
    Write-Host "[+] Firewall rule created successfully."
} catch {
    Write-Host "[-] Firewall rule creation failed (may already exist or requires elevation)."
}