FSA-202405 — Festo: Siemens S7-1500/ET200SP CPU used in Festo Didactic products contains a memory protection bypass vulnerability

Summary

Siemens SIMATIC S7-1200 and S7-1500 CPUs contained in various Festo Didactic products contain a memory protection bypass vulnerability that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks

Details

Impact
Siemens SIMATIC S7-1200 and S7-1500 CPUs have a memory protection bypass vulnerability allowing attackers to write or read data in protected memory, potentially enabling further attacks.

Remediation
Update Siemens Simatic S7-1500 / ET200SP Firmware to V2.9.2 or higher

Vulnerabilities 1

Critical 9.8

CVE-2020-15782

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open C…

Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) SIMATIC S7-1500 Software Controller ICS / OT

May 28, 2021

Revision history

2025-11-05 #3.0.1
Removed environmental score from CVSS rating.
2025-02-27 #3.0.0
Update: new Dokument ID
2024-11-06 #2.0.0
Fix: correct certvde domain, fixed language setting, added self-reference
2024-09-09 #1.0.0
Initial version

References

For further security-related issues in Festo products please contact the Festo Product Security Incident Response Team (PSIRT)
https://festo.com/psirt
CERT@VDE Security Advisories for Festo
https://certvde.com/en/advisories/vendor/festo
FSA-202405: Festo: Siemens S7-1500/ET200SP CPU used in Festo Didactic products contains a memory protection bypass vulnerability - HTML
https://certvde.com/en/advisories/VDE-2024-055
Link to CVE
https://www.cve.org/CVERecord?id=CVE-2020-15782