High SSA-557541 1 CVE

SSA-557541: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs

Published Apr 12, 2022 · Updated Apr 11, 2023 · Revision 3

Summary

SIMATIC S7-400 CPU devices contain an input validation vulnerability that could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations.

Siemens has released an update for SIMATIC S7-410 V10 CPU family and SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants for both) and recommends to update to the latest version. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not yet available.

Vulnerabilities 1

High 7.5

CVE-2021-40368

A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (A…

Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7 SIMATIC S7-400 CPU 416-3 PN/DP V7 SIMATIC S7-400 CPU 414F-3 PN/DP V7 ICS / OT

Apr 12, 2022

Revision history

2023-04-11 #3
Added explicit MLFBs and fixes for SIMATIC S7-400 V7 CPUs (incl. SIPLUS variants)
2022-08-09 #2
Added fix for SIMATIC S7-410 CPU family
2022-04-12 #1
Publication Date

References

SSA-557541: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-557541.html
SSA-557541: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-557541.pdf
SSA-557541: Denial-of-Service Vulnerability in SIMATIC S7-400 CPUs - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-557541.txt