Skip to content
OpenAdvisories
High SSA-838121 3 CVEs

SSA-838121: Multiple Denial of Service Vulnerabilities in Industrial Products

Published Feb 8, 2022 · Updated Apr 11, 2023 · Revision 4

Vendor: Siemens Product: SIMATIC Drive Controller family Product: SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) Product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) Product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 Ready4Linux Product: SIMATIC S7-1200 CPU family (incl. SIPLUS variants) Product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) Product: SIMATIC S7-1500 Software Controller Product: SIMATIC S7-PLCSIM Advanced Product: SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) Product: TIM 1531 IRC (6GK7543-1MX00-0XE0)

Summary

Affected SIMATIC firmware contains three vulnerabilities that could allow an unauthenticated attacker to perform a denial of service attack under certain conditions.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.

Vulnerabilities 3

Revision history

  1. #4

    Added fix for TIM 1531 IRC

  2. #3

    Added fix for SIMATIC ET 200SP Open Controller CPU 1515SP PC2 and SIMATIC S7-1500 Software Controller, clarify that CVE-2021-37204 is also affecting devices without TLS and added SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) and SIMATIC ET 200SP Open Controller CPU 1515SP PC2 'Ready4Linux' as affected by CVE-2021-37204

  3. #2

    Added solution for SIMATIC S7-PLCSIM Advanced

  4. #1

    Publication Date

References