Skip to content
OpenAdvisories
Medium SSA-293562 2 CVEs

SSA-293562: Denial of Service Vulnerabilities in PROFINET DCP Implementation of Industrial Products

Published May 8, 2017 · Updated Sep 10, 2024 · Revision 27

Vendor: Siemens Product: Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller Product: Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 Product: Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P Product: IE/AS-i Link PN IO Product: IE/PB-Link (incl. SIPLUS NET variants) Product: SCALANCE M-800 family (incl. S615, MUM-800 and RM1224) Product: SCALANCE W-700 IEEE 802.11n family Product: SCALANCE X-200 family (incl. SIPLUS NET variants) Product: SCALANCE X-200IRT family (incl. SIPLUS NET variants) Product: SCALANCE X-300 family (incl. X408 and SIPLUS NET variants) Product: SCALANCE X408 family Product: SCALANCE X414 Product: SCALANCE XM-400 family Product: SCALANCE XR-500 family Product: SIMATIC CM 1542-1 Product: SIMATIC CM 1542SP-1 Product: SIMATIC CP 1243-1 (incl. SIPLUS variants) Product: SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) Product: SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) Product: SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) Product: SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants) Product: SIMATIC CP 1543-1 (incl. SIPLUS variants) Product: SIMATIC CP 1543SP-1 (incl. SIPLUS variants) Product: SIMATIC CP 1604 (6GK1160-4AA01) Product: SIMATIC CP 1616 (6GK1161-6AA02) Product: SIMATIC CP 343-1 (incl. SIPLUS variants) Product: SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) Product: SIMATIC CP 343-1 Lean (incl. SIPLUS variants) Product: SIMATIC CP 443-1 (incl. SIPLUS variants) +97 more

Summary

Several industrial devices are affected by two vulnerabilities that could allow an attacker to cause a denial of service condition via PROFINET DCP network packets under certain circumstances. The precondition for this scenario is a direct layer 2 access to the affected products. PROFIBUS interfaces are not affected.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 2

Revision history

  1. #27

    Clarified and updated impact of CVE-2017-2681 to the individual products; further consolidation in product list

  2. #26

    Listed affected products individually instead of product families (e.g., for SIMATIC MV400, SIMATIC ET 200AL/MP/SP/pro IM families); added affected SIPLUS devices (e.g., SIPLUS ET 200xx IM)

  3. #25

    No remediation planned for SIMATIC CP 443-1 OPC UA; added more information to the advisory title; no remediation planned for ET200 devices

  4. #24

    Clarified product name for SIMATIC NET CP 443-1 OPC UA and clarified affected ET200ecoPN models

  5. #23

    Consolidated product names and added SIMATIC ET200SP IM155-6 PN HS to the advisory

  6. #22

    Added ecoPN model (6ES7148-6JG00-0BB0) as not affected. Added MV400 and update information. Updated CWE classification for CVE-2017-2680 and CVE-2017-2681

  7. #21

    Informed about successor product for SIMATIC Teleservice adapters. Added SIMATIC ET200ecoPN product variants (MLFB IDs) that are not affected

  8. #20

    Added SIMATIC TDC CP51M1 and CPU555 to the list of affected products

  9. #19

    SIPLUS devices now explicitly mentioned in the list of affected products

  10. #18

    Renamed SIMATIC WinAC RTX 2010 incl. F to SIMATIC WinAC RTX (F) 2010 and updated information for SIMATIC WinAC RTX (F) 2010

  11. #17

    Updated information for CP 1243-1

  12. #16

    Corrected download links, update for CP 1243-1 not available, see mitigations

  13. #15

    Updated information for SIMATIC ET 200MP IM155-5 PN HF, SIRIUS ACT 3SU1 interface module PROFINET

  14. #14

    Updated information for SINAMICS S120, SIMATIC ET 200SP (except IM155-6 PN ST), SIMATIC Panels

  15. #13

    Added update information for SIMATIC CP 343-1 Std and CP 343-1 Lean

  16. #12

    Added update information for SCALANCE X-200IRT

  17. #11

    Refined ET 200MP product family; Added update information for ET 200MP IM155-5 PN ST

  18. #10

    Corrected information for SIMATIC CM 1542-1 and ET 200MP. Added solution for SINAMICS DCP, and S7-400 V7 PN/DP

  19. #9

    New advisory format, added update information for SIMOCODE pro V PROFINET

  20. #8

    Added update information for SCALANCE X-200 and SIMATIC S7-400 PN/DP V6 Incl. F

  21. #7

    Added upgrade and update information for Softnet PROFINET IO and SIMATC ET 200AL

  22. #6

    Detailed SIMATIC CP 1243-1, Added update information for SIMATIC CP 1243-1, 1243-1 IRC, SINAMICS DCM and added upgrade information for PN/PN Coupler

  23. #5

    Added update information for SCALANCE M-800 / S615

  24. #4

    Added update information for SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, and CP 1543SP-1, SIMATIC ET 200SP, SIMATIC S7-200 SMART, SINAMICS G130, G150, and S150, and SINUMERIK 828D; Adjusted update information for Development/Evaluation Kits

  25. #3

    Added update information for SCALANCE XM-400, SCALANCE XR-500, SIMATIC S7-400-H V6, SINAMICS S110, SINAMICS S120 and SINAMICS V90

References