Skip to content
OpenAdvisories
Medium SSA-603476 2 CVEs

SSA-603476: Web Vulnerabilities in SIMATIC NET CP 343-1/CP 443-1 Modules and SIMATIC S7-300/S7-400 CPUs

Published Nov 21, 2016 · Updated Apr 11, 2023 · Revision 5

Vendor: Siemens Product: SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) Product: SIMATIC CP 443-1 Advanced (incl. SIPLUS variants) Product: SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) Product: SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants)

Summary

SIMATIC CP 343-1 Advanced/CP-443-1 Advanced devices and SIMATIC S7-300/S7-400 CPUs are affected by two vulnerabilities. One of the vulnerabilities could allow remote attackers to perform operations as an authenticated user under certain conditions.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 2

  • Unscored —
    CVE-2016-8672

    A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), S…

  • Unscored —
    CVE-2016-8673

    A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), S…

Revision history

  1. #5

    Added fix for SIMATIC S7-300 CPU familiy, no fix planned for SIMATIC S7-400 CPU familiy

  2. #4

    SIPLUS devices now explicitly mentioned in the list of affected products

  3. #3

    Corrected affected products from S7-400 CPUs to S7-400 PN/DP incl. F as not all S7-400 CPUs are affected

  4. #2

    Added update information for SIMATIC CP 443-1 Advanced

  5. #1

    Publication Date

References