Description
A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle long file names correctly.
This could allow an attacker to create a buffer overflow and create a denial of service condition for the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC PC-Station Plus | All versions | — |
| Siemens | SIMATIC S7-400 CPU 412-2 PN V7 | All versions | — |
| Siemens | SIMATIC S7-400 CPU 414-3 PN/DP V7 | All versions | — |
| Siemens | SIMATIC S7-400 CPU 414F-3 PN/DP V7 | All versions | — |
| Siemens | SIMATIC S7-400 CPU 416-3 PN/DP V7 | All versions | — |
| Siemens | SIMATIC S7-400 CPU 416F-3 PN/DP V7 | All versions | — |
| Siemens | SINAMICS S120 (incl. SIPLUS variants) | All versions < V5.2 SP3 HF15 | — |
| Siemens | SIPLUS S7-400 CPU 414-3 PN/DP V7 | All versions | — |
| Siemens | SIPLUS S7-400 CPU 416-3 PN/DP V7 | All versions | — |
Advisories 3
- ICSA-23-348-05 Siemens SIMATIC and SIPLUS Products CISA ICS & IT advisories · Dec 12, 2023
- SSA-892915 SSA-892915: Multiple Denial of Service Vulnerabilities in the Webserver of Industrial Products Siemens ProductCERT · Dec 12, 2023
- WID-SEC-2023-3101 Siemens SIMATIC S7-400 CPU: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Dec 11, 2023