Publication Date:
Last Update:
Current Version: V3.5
CVSS v3.1 Base Score: 6.5
Un-/Collapse All
Affected Product and Versions Remediation

All versions < V4.1.1 Patch04
affected by all CVEs

All versions < V4.2.1 Patch03
affected by all CVEs

All versions < V4.4.0 Patch01
affected by all CVEs

All versions < V4.03
affected by all CVEs

All versions < V6.1
affected by all CVEs

All versions < V3.10.2
affected by all CVEs

All versions < V5.2.2
affected by all CVEs

All versions < V5.4.0
affected by all CVEs

All versions < V4.1.0
affected by all CVEs
Expand children
Update to V6.2 or later version

All versions < V2.0
affected by all CVEs

All versions < V1.0.15
affected by all CVEs

All versions < V3.1.3
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is available

All versions < V3.1.3
affected by all CVEs

All versions < V3.2.17
affected by all CVEs

All versions < V3.2.17
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is planned

All versions < V2.1.82
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is available

All versions
affected by all CVEs
Currently no fix is available

All versions < V2.1.82
affected by all CVEs

All versions < V1.0.15
affected by all CVEs

All versions < V2.1
affected by all CVEs

All versions < V1.0.15
affected by all CVEs

All versions < V2.7
affected by all CVEs

All versions < V2.7
affected by all CVEs

All versions < V2.7
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions < V1.0.2
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is planned

All versions < V4.0.1
affected by all CVEs
Expand children
Expand children

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned
Expand children

All versions < V4.0.1
affected by all CVEs
Expand children

All versions < V15.1
affected by all CVEs
Expand children

All versions < V4.0
affected by all CVEs
Expand children

All versions < V2.3
affected by all CVEs
Contact your local Siemens representative or the Siemens customer support at https://w3.siemens.com/aspa_app/ to receive firmware version 2.3. Update to V2.3

All versions < V6.0.7
affected by all CVEs

All versions < V6.0.6
affected by all CVEs

All versions < V7.0.2
affected by all CVEs

All versions < V8.2
affected by all CVEs

All versions < V4.2.1
affected by all CVEs

All versions < V2.1
affected by all CVEs

All versions < V1.1.8
affected by all CVEs

All versions < V1.1.1
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions
affected by all CVEs
Currently no fix is planned

All versions < V2010 SP3
affected by all CVEs
Update to V2010 SP3 or later version and apply BIOS and Microsoft Windows updates

All versions < V2010 SP3
affected by all CVEs
Update to V2010 SP3 or later version and apply BIOS and Microsoft Windows updates

All versions < V2.0.0
affected by all CVEs

All versions < V4.5 HF1
affected by all CVEs

All versions < V1.4 SP1 HF5
affected by all CVEs

All versions < V1.2 HF1
affected by all CVEs

All versions < V4.7 SP6 HF3
affected by all CVEs

All versions < V4.7 SP6 HF3
affected by all CVEs

All versions < V4.7 HF27
affected by all CVEs

All versions < V4.8 HF4
affected by all CVEs

V4.7: All versions < V4.7 HF27
affected by all CVEs

All versions < V4.8 HF4
affected by all CVEs

All versions < V4.4 SP3 HF5
affected by all CVEs

All versions < V4.7
affected by all CVEs

All versions
affected by all CVEs

All versions < V4.7 HF27
affected by all CVEs

All versions < V4.8 HF4
affected by all CVEs

All versions < V4.7 HF27
affected by all CVEs

All versions < V4.8 HF4
affected by all CVEs

All versions < V1.01
affected by all CVEs

All versions < V4.5 SP6 HF2
affected by all CVEs
Update to V4.5 SP6 HF2

All versions < V4.7 SP4 HF1
affected by all CVEs
Update to V4.7 SP4 HF1.

All versions < V4.5 SP6 HF2
affected by all CVEs
Update to V4.5 SP6 HF2

All versions < V4.7 SP4 HF1
affected by all CVEs
Update to V4.7 SP4 HF1

All versions < V1.1.0
affected by all CVEs

All versions
affected by all CVEs
Currently no fix is available

All versions
affected by all CVEs
Currently no fix is available

All versions < V1.2.0
affected by all CVEs

All versions < V2.2.0
affected by all CVEs

All versions < V14 SP1
affected by all CVEs
  • Use VPN for protecting network communication between cells.
  • For SIMATIC Teleservice Adapters (IE Basic, IE Standard, IE Advanced): migrate to a successor product within the SCALANCE M-800 family. For details refer to the [notice of discontinuation](https://support.industry.siemens.com/cs/ww/en/view/109781070).

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

CVSS v3.1 Base Score 6.5
CVSS v3.1 Vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CWE CWE-400: Uncontrolled Resource Consumption
CVSS v3.1 Base Score 6.5
CVSS v3.1 Vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
CWE CWE-400: Uncontrolled Resource Consumption

  • Artem Zinenko from Kaspersky for pointing out that SIPLUS should also be mentioned
  • Duan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team for coordinated disclosure
  • CNCERT/CC for coordination efforts

https://www.siemens.com/cert/advisories
V1.0 (2017-05-08): Publication Date
V1.1 (2017-06-13): Added update information for SALANCE X-300/X408, X414, SITOP PSU8600/ UPS 1600 PROFINET and S7-400
V1.2 (2017-07-21): Added update information for SCALANCE XM-400, SCALANCE XR-500, SIMATIC S7-400-H V6, SINAMICS S110, SINAMICS S120 and SINAMICS V90
V1.3 (2017-08-16): Added update information for SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, and CP 1543SP-1, SIMATIC ET 200SP, SIMATIC S7-200 SMART, SINAMICS G130, G150, and S150, and SINUMERIK 828D; Adjusted update information for Development/Evaluation Kits
V1.4 (2017-09-13): Added update information for SCALANCE M-800 / S615
V1.5 (2017-10-09): Detailed SIMATIC CP 1243-1, Added update information for SIMATIC CP 1243-1, 1243-1 IRC, SINAMICS DCM and added upgrade information for PN/PN Coupler
V1.6 (2017-11-09): Added upgrade and update information for Softnet PROFINET IO and SIMATC ET 200AL
V1.7 (2017-11-23): Added update information for SCALANCE X-200 and SIMATIC S7-400 PN/DP V6 Incl. F
V1.8 (2018-01-18): New advisory format, added update information for SIMOCODE pro V PROFINET
V1.9 (2018-01-24): Corrected information for SIMATIC CM 1542-1 and ET 200MP. Added solution for SINAMICS DCP, and S7-400 V7 PN/DP
V2.0 (2018-02-22): Refined ET 200MP product family; Added update information for ET 200MP IM155-5 PN ST
V2.1 (2018-03-06): Added update information for SCALANCE X-200IRT
V2.2 (2018-05-03): Added update information for SIMATIC CP 343-1 Std and CP 343-1 Lean
V2.3 (2018-11-13): Updated information for SINAMICS S120, SIMATIC ET 200SP (except IM155-6 PN ST), SIMATIC Panels
V2.4 (2018-12-11): Updated information for SIMATIC ET 200MP IM155-5 PN HF, SIRIUS ACT 3SU1 interface module PROFINET
V2.5 (2018-12-13): Corrected download links, update for CP 1243-1 not available, see mitigations
V2.6 (2019-01-08): Updated information for CP 1243-1
V2.7 (2019-10-08): Renamed SIMATIC WinAC RTX 2010 incl. F to SIMATIC WinAC RTX (F) 2010 and updated information for SIMATIC WinAC RTX (F) 2010
V2.8 (2020-02-10): SIPLUS devices now explicitly mentioned in the list of affected products
V2.9 (2020-07-14): Added SIMATIC TDC CP51M1 and CPU555 to the list of affected products
V3.0 (2020-08-11): Informed about successor product for SIMATIC Teleservice adapters. Added SIMATIC ET200ecoPN product variants (MLFB IDs) that are not affected
V3.1 (2021-03-09): Added ecoPN model (6ES7148-6JG00-0BB0) as not affected. Added MV400 and update information. Updated CWE classification for CVE-2017-2680 and CVE-2017-2681
V3.2 (2021-06-08): Consolidated product names and added SIMATIC ET200SP IM155-6 PN HS to the advisory
V3.3 (2021-10-12): Clarified product name for SIMATIC NET CP 443-1 OPC UA and clarified affected ET200ecoPN models
V3.4 (2022-02-08): No remediation planned for SIMATIC CP 443-1 OPC UA; added more information to the advisory title; no remediation planned for ET200 devices
V3.5 (2024-07-09): Listed affected products individually instead of product families (e.g., for SIMATIC MV400, SIMATIC ET 200AL/MP/SP/pro IM families); added affected SIPLUS devices (e.g., SIPLUS ET 200xx IM)