Denial-of-Service Vulnerability in SIMATIC Drive Controller and S7 Firmware from Siemens
CVE-2021-37204

7.5HIGH

Key Information:

Vendor
Siemens
Status
Simatic Drive Controller Family
Simatic Et 200sp Open Controller Cpu 1515sp Pc (incl. Siplus Variants)
Simatic Et 200sp Open Controller Cpu 1515sp Pc2 (incl. Siplus Variants)
Simatic Et 200sp Open Controller Cpu 1515sp Pc2 Ready4linux
Vendor
CVE Published:
9 February 2022

Summary

A vulnerability has been discovered within the Siemens SIMATIC Drive Controller family and associated products, allowing unauthenticated attackers to induce a denial-of-service condition. This can be achieved by sending specially crafted packets to the affected devices over port 102/tcp, potentially leading to operational disruptions. Restoring normal functionality necessitates a device restart, highlighting a significant risk for environments relying on continuous operation of these controllers.

Affected Version(s)

SIMATIC Drive Controller family All versions < V2.9.2

SIMATIC Drive Controller family All versions >= V2.9.2 < V2.9.4

SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) All versions

References

https://cert-portal.siemens.com/productcert/pdf/ssa-83812...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.