Description
The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service condition of the ICMP service, other communication services are not affected. Affected devices will resume normal operation after the attack terminates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIDOOR ATD430W | — | — |
| Siemens | SIDOOR ATE530G COATED | — | — |
| Siemens | SIDOOR ATE530S COATED | — | — |
| Siemens | SIMATIC CFU DIQ | < V2.0.0 | V2.0.0 |
| Siemens | SIMATIC CFU PA | < V2.0.0, < V2.0 | V2.0.0 |
| Siemens | SIMATIC ET 200AL IM 157-1 PN | — | — |
| Siemens | SIMATIC ET 200M IM 153-4 PN IO HF | — | — |
| Siemens | SIMATIC ET 200M IM 153-4 PN IO ST | — | — |
| Siemens | SIMATIC ET 200MP IM 155-5 PN BA | — | — |
| Siemens | SIMATIC ET 200MP IM 155-5 PN HF | — | — |
| Siemens | SIMATIC ET 200MP IM 155-5 PN ST | — | — |
| Siemens | SIMATIC ET 200pro IM 154-3 PN HF | — | — |
| Siemens | SIMATIC ET 200pro IM 154-4 PN HF | — | — |
| Siemens | SIMATIC ET 200pro IM 154-8 PN/DP CPU | — | — |
| Siemens | SIMATIC ET 200pro IM 154-8F PN/DP CPU | — | — |
| Siemens | SIMATIC ET 200pro IM 154-8FX PN/DP CPU | — | — |
| Siemens | SIMATIC ET 200S IM 151-3 PN FO | — | — |
| Siemens | SIMATIC ET 200S IM 151-3 PN HF | — | — |
| Siemens | SIMATIC ET 200S IM 151-3 PN HS | — | — |
| Siemens | SIMATIC ET 200S IM 151-3 PN ST | — | — |
| Siemens | SIMATIC ET 200S IM 151-8 PN/DP CPU | — | — |
| Siemens | SIMATIC ET 200S IM 151-8F PN/DP CPU | — | — |
| Siemens | SIMATIC ET 200SP CPU 1510SP F-1 PN | — | — |
| Siemens | SIMATIC ET 200SP CPU 1510SP-1 PN | — | — |
| Siemens | SIMATIC ET 200SP CPU 1512SP F-1 PN | — | — |
| Siemens | SIMATIC ET 200SP CPU 1512SP-1 PN | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 MF HF | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN BA | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) | < V1.3 | V1.3 |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HF | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HS | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN ST | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN ST BA | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN/2 HF | — | — |
| Siemens | SIMATIC ET 200SP IM 155-6 PN/3 HF | — | — |
| Siemens | SIMATIC PN/PN Coupler | < V6.0.0 | V6.0.0 |
| Siemens | SIMATIC Power Line Booster PLB, Base Module | — | — |
| Siemens | SIMATIC Power Line Booster PLB, Modem Module ST | — | — |
| Siemens | SIMATIC S7-1200 CPU 1211C AC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1211C DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1211C DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1212C AC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1212C DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1212C DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1212FC DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1212FC DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1214C AC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1214C DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1214C DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1214FC DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1214FC DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1215C AC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1215C DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1215C DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1215FC DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1215FC DC/DC/Rly | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1200 CPU 1217C DC/DC/DC | < V4.4 | V4.4 |
| Siemens | SIMATIC S7-1500 CPU 1511-1 PN | — | — |
| Siemens | SIMATIC S7-1500 CPU 1511F-1 PN | — | — |
| Siemens | SIMATIC S7-1500 CPU 1513-1 PN | — | — |
| Siemens | SIMATIC S7-1500 CPU 1513F-1 PN | — | — |
| Siemens | SIMATIC S7-1500 CPU 1515-2 PN | — | — |
| Siemens | SIMATIC S7-1500 CPU 1515F-2 PN | — | — |
| Siemens | SIMATIC S7-1500 CPU 1516-3 PN/DP | — | — |
| Siemens | SIMATIC S7-1500 CPU 1516F-3 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 314C-2 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 315-2 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 315F-2 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 315T-3 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 317-2 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 317F-2 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 317T-3 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 317TF-3 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 319-3 PN/DP | — | — |
| Siemens | SIMATIC S7-300 CPU 319F-3 PN/DP | — | — |
| Siemens | SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) | — | — |
| Siemens | SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) | — | — |
| Siemens | SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) | < V10.2 | V10.2 |
| Siemens | SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) | < V8.3 | V8.3 |
| Siemens | SIMATIC TDC CP51M1 | — | — |
| Siemens | SIMATIC TDC CPU555 | — | — |
| Siemens | SIMOCODE pro V Ethernet/IP (incl. SIPLUS variants) | — | — |
| Siemens | SIMOCODE pro V PROFINET | — | — |
| Siemens | SINUMERIK 840D sl | — | — |
| Siemens | SIPLUS ET 200M IM 153-4 PN IO HF | — | — |
| Siemens | SIPLUS ET 200M IM 153-4 PN IO ST | — | — |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF | — | — |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL | — | — |
| Siemens | SIPLUS ET 200MP IM 155-5 PN ST | — | — |
| Siemens | SIPLUS ET 200MP IM 155-5 PN ST TX RAIL | — | — |
| Siemens | SIPLUS ET 200S IM 151-8 PN/DP CPU | — | — |
| Siemens | SIPLUS ET 200S IM 151-8F PN/DP CPU | — | — |
| Siemens | SIPLUS ET 200S IM151-3 PN HF | — | — |
| Siemens | SIPLUS ET 200S IM151-3 PN ST | — | — |
| Siemens | SIPLUS ET 200SP CPU 1512SP F-1 PN | — | — |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF | — | — |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL | — | — |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF TX RAIL | — | — |
| Siemens | SIPLUS ET 200SP IM 155-6 PN ST | — | — |
| Siemens | SIPLUS ET 200SP IM 155-6 PN ST BA | — | — |
Advisories 8
- SSA-725549 SSA-725549: Denial of Service of ICMP in Industrial Devices Siemens ProductCERT · Jul 21, 2025
- ICSA-25-105-03 Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX CISA ICS & IT advisories · Jul 10, 2025
- ICSA-25-044-09 Siemens SCALANCE W700 IEEE 802.11ax CISA ICS & IT advisories · May 6, 2025
- NCSC-2025-0106 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Apr 8, 2025
- WID-SEC-2025-0736 Siemens SIMATIC S7: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 7, 2025
- NCSC-2025-0061 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 14, 2025
- NCSC-2025-0051 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Feb 11, 2025
- SSA-769027 SSA-769027: Multiple Vulnerabilities fixed in SCALANCE W700 IEEE 802.11ax devices before V3.0.0 Siemens ProductCERT · Feb 11, 2025