Denial-of-Service Vulnerability in Siemens SIMATIC PLCs and Controllers
CVE-2021-37205

7.5HIGH

Key Information:

Vendor
Siemens
Status
Simatic Drive Controller Family
Simatic Et 200sp Open Controller Cpu 1515sp Pc2 (incl. Siplus Variants)
Simatic S7-1200 Cpu Family (incl. Siplus Variants)
Simatic S7-1500 Cpu Family (incl. Related Et200 Cpus And Siplus Variants)
Vendor
CVE Published:
9 February 2022

Summary

A vulnerability has been detected in various Siemens SIMATIC products, allowing unauthenticated attackers to trigger a denial-of-service condition. By sending specially crafted packets over port 102/tcp, an attacker can impede the normal operations of affected devices, requiring a restart to restore functionality. This affects multiple versions of the SIMATIC Drive Controller, S7-1200, S7-1500 series CPUs, and other related products. Ensuring up-to-date software and implementing security measures is crucial to mitigate risks.

Affected Version(s)

SIMATIC Drive Controller family All versions >= V2.9.2 < V2.9.4

SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) All versions >= V21.9 < V21.9.4

SIMATIC S7-1200 CPU family (incl. SIPLUS variants) All versions >= V4.5.0 < V4.5.2

References

https://cert-portal.siemens.com/productcert/pdf/ssa-83812...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.