Skip to content
OpenAdvisories
High SSA-780073 1 CVE

SSA-780073: Denial of Service Vulnerability in PROFINET Devices via DCE-RPC Packets

Published Feb 11, 2020 · Updated Jul 9, 2024 · Revision 15

Vendor: Siemens Product: Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller Product: Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 Product: Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P Product: PROFINET Driver for Controller Product: RUGGEDCOM RM1224 family (6GK6108-4AM00) Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M876-3 (6GK5876-3AA02-2BA2) Product: SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) Product: SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) Product: SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) Product: SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) Product: SCALANCE W-700 IEEE 802.11n family Product: SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) Product: SCALANCE X201-3P IRT (6GK5201-3BH00-2BA3) Product: SCALANCE X201-3P IRT PRO (6GK5201-3JR00-2BA6) Product: SCALANCE X202-2IRT (6GK5202-2BB00-2BA3) Product: SCALANCE X202-2P IRT (6GK5202-2BH00-2BA3) Product: SCALANCE X202-2P IRT PRO (6GK5202-2JR00-2BA6) Product: SCALANCE X204-2 (6GK5204-2BB10-2AA3) Product: SCALANCE X204-2FM (6GK5204-2BB11-2AA3) Product: SCALANCE X204-2LD (6GK5204-2BC10-2AA3) Product: SCALANCE X204-2LD TS (6GK5204-2BC10-2CA2) +119 more

Summary

Products that include the Siemens PROFINET-IO (PNIO) stack in versions prior V06.00 are potentially affected by a denial of service vulnerability when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

Additionally, Siemens recommends other vendors of PROFINET devices to check if their products have incorporated a vulnerable version of the Siemens PNIO stack as part of the Siemens Development/Evaluation Kits.

Vulnerabilities 1

Revision history

  1. #15

    Listed affected products individually instead of product families (e.g., for SIMATIC MV400, SIMATIC ET 200AL/MP/SP/pro IM families); added affected SIPLUS devices (e.g., SIPLUS ET 200xx IM); corrected fix version for SIMATIC ET 200SP IM 155-6 PN HF

  2. #14

    Added fix for SIMATIC CP 443-1 family

  3. #13

    No fix planned for SIMATIC CP 443-1 Advanced and SIPLUS NET CP 443-1 Advanced

  4. #12

    Added solution for SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)

  5. #11

    No remediation planned for SIMATIC CP 343-1 (incl. Advanced, ERPC, Lean and related SIPLUS variants), SIMATIC CP 443-1 OPC UA, SIMATIC ET200 devices, and SOFTNET-IE PNIO

  6. #10

    Clarified affected ET200ecoPN models

  7. #9

    Added solution for SCALANCE X-200 switch family, explicitly list SCALANCE XB-200, XC-200, XP-200, XF-200BA and XR-300WG, as well as SCALANCE M-800 / S615 as separate products

  8. #8

    Added ecoPN model (6ES7148-6JG00-0BB0) as not affected. Added update information for MV400

  9. #7

    Added SIMOTION products; Updated information regarding successor products for SIMATIC RF180C and RF182C

  10. #6

    Informed about successor products for SIMATIC RF180C and RF182C

  11. #4

    No changes - this version was never released

  12. #5

    Added SIMATIC ET200ecoPN product variants (MLFB IDs) that are not affected

  13. #3

    Additional information in section "Workarounds and Mitigations"

  14. #2

    Added affected product SOFTNET-IE PNIO

  15. #1

    Publication Date

References