Predictable IP ID sequence numbers leave SIMATIC S7-200 SMART CPU susceptible to denial of service attacks

CVE-2024-35292

Summary

A vulnerability exists in various models of the SIMATIC S7-200 SMART CPU series produced by Siemens, specifically linked to the use of a predictable IP ID sequence number. This issue allows malicious actors to exploit the predictable nature of the IP ID sequences, potentially enabling a range of attacks including denial of service. Systems affected by this vulnerability may experience operational disruptions as attackers leverage the predictability to manipulate network traffic and create conditions that hinder system functionality. It is critical for organizations to assess their configurations and apply necessary safeguards to mitigate the risk associated with this vulnerability.

References