Skip to content
OpenAdvisories
High SSA-480230 1 CVE

SSA-480230: Denial of Service Vulnerability in Webserver of Industrial Products

Published Apr 9, 2019 · Updated May 9, 2023 · Revision 18

Vendor: Siemens Product: SIMATIC CP 1604 (6GK1160-4AA01) Product: SIMATIC CP 1616 (6GK1161-6AA02) Product: SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0) Product: SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) Product: SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) Product: SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) Product: SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) Product: SIMATIC ET 200pro IM154-8 PN/DP CPU (6ES7154-8AB01-0AB0) Product: SIMATIC ET 200pro IM154-8F PN/DP CPU (6ES7154-8FB01-0AB0) Product: SIMATIC ET 200pro IM154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) Product: SIMATIC ET 200S IM151-8 PN/DP CPU (6ES7151-8AB01-0AB0) Product: SIMATIC ET 200S IM151-8F PN/DP CPU (6ES7151-8FB01-0AB0) Product: SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) Product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) Product: SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) Product: SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) Product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F Product: SIMATIC IPC DiagMonitor Product: SIMATIC RF182C (6GT2002-0JD10) Product: SIMATIC RF185C (6GT2002-0JE10) Product: SIMATIC RF186C (6GT2002-0JE20) Product: SIMATIC RF188C (6GT2002-0JE40) Product: SIMATIC RF600R family Product: SIMATIC RFID 181EIP (6GT2002-0JD20) Product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) Product: SIMATIC S7-1500 Software Controller Product: SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) Product: SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) Product: SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) +57 more

Summary

A vulnerability in the affected devices could allow an unauthorized attacker
with network access to the webserver of an affected device to perform a
denial of service attack.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 1

Revision history

  1. #18

    Updated fix information for SINAMICS S210

  2. #17

    Added fix for SIMATIC CP 443-1 and CP 443-1 Advanced and for SINAMICS S210

  3. #16

    SIMATIC S7-300 CPU family expanded with product specific designations, patch links and MLFBs and Name of SIMOCODE pro V EIP (incl. SIPLUS variants) was updated to SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants) and Name of SIMOCODE pro V PN (incl. SIPLUS variants) was updated to SIMOCODE pro V PROFINET (incl. SIPLUS variants); No fix planned for SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)

  4. #15

    No fix planned for SIMATIC S7-400 PN/DP V6 and below CPU family; consolidated mitigation measures

  5. #14

    No fix planned for SIMATIC CP 443-1 Advanced and SIPLUS NET CP 443-1 Advanced

  6. #13

    No remediation planned for SIMATIC CP 343-1 Advanced, SIMATIC CP 443-1 OPC UA, SIMATIC CP 1604, SIMATIC CP 1616, and SIPLUS NET CP 343-1 Advanced

  7. #12

    Updated information regarding successor products for SIMATIC RF182C and RFID 181EIP

  8. #11

    Informed about successor products for SIMATIC RF182C and RFID 181EIP

  9. #10

    Added update for SIMOCODE pro V EIP; informed about successor product for SIMATIC Teleservice adapters

  10. #9

    Added update for SIMOCODE pro V PN; clarified update version information for SINAMICS G130/G150/S150 and SINAMICS S120

  11. #8

    Added update for SIMATIC IPC DiagMonitor

  12. #7

    Added update for SITOP PSU8600, TIM 1531 IRC

  13. #6

    Added update for WinCC Runtime Advanced, SITOP Manager, SITOP UPS1600, and SIMATIC HMI Panels. SIPLUS devices now explicitly mentioned in the list of affected products

  14. #5

    Renamed SIMATIC WinAC RTX 2010 to SIMATIC WinAC RTX (F) 2010 and added update for SIMATIC WinAC RTX (F) 2010

  15. #4

    Added update for SIMATIC RF600 family, SIMATIC RF185C, SIMATIC RF186C, and SIMATIC RF188C

  16. #3

    Added update for SIMATIC Software Controller and SIMATIC ET 200 SP Open Controller CPU 1515SP PC2

  17. #2

    Specification for SINAMICS products, added solution for SIMATIC S7-1500 CPU family and SIMATIC S7-PLCSIM Advanced

  18. #1

    Publication Date

References