Publication Date: |
|
Last Update: |
|
Current Version: | V3.6 |
CVSS v3.1 Base Score: | 6.5 |
CVSS v4.0 Base Score: | 7.1 |
Affected Product and Versions | Remediation |
---|---|
All versions < V4.1.1 Patch04 affected by all CVEs |
Update to V4.1.1 Patch04 or newer
|
All versions < V4.2.1 Patch03 affected by all CVEs |
Update to V4.2.1 Patch03 or newer
|
All versions < V4.4.0 Patch01 affected by all CVEs |
Update to V4.4.0 Patch01 or newer
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V3.0 affected by all CVEs |
Upgrade to V3.0
|
All versions < V4.03 affected by all CVEs |
Update to V5.00
|
All versions < V6.1 affected by all CVEs |
Update to V6.3.1
|
All versions < V3.10.2 affected by all CVEs |
Update to V3.10.2
|
All versions < V5.2.2 affected by all CVEs |
Update to V5.2.2
|
All versions < V5.4.0 affected by all CVEs |
Update to V5.4.0
|
All versions < V4.1.0 affected by all CVEs |
Update to V4.1.2
|
|
Update to V6.2 or later version
|
All versions < V2.0 affected by all CVEs |
Update to V2.0
|
All versions < V1.0.15 affected by all CVEs |
Update to V1.0.15
|
All versions < V3.1.3 affected by all CVEs |
Update to V3.1.3
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V3.1.3 affected by all CVEs |
Update to V3.1.3
|
All versions < V3.2.17 affected by all CVEs |
Update to V3.2.17
|
All versions < V3.2.17 affected by all CVEs |
Update to V3.2.17
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V2.1.82 affected by all CVEs |
Update to V3.1
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V2.1.82 affected by all CVEs |
Update to V3.1
|
All versions < V1.0.15 affected by all CVEs |
Update to V1.0.15
|
All versions < V2.1 affected by all CVEs |
Update to V2.1
|
All versions < V1.0.15 affected by all CVEs |
Update to V1.0.15
|
All versions < V2.7 affected by all CVEs |
Update to V2.8.0
|
All versions < V2.7 affected by all CVEs |
Update to V2.8.0
|
All versions < V2.7 affected by all CVEs |
Update to V2.8.0
|
|
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V1.0.2 affected by all CVEs |
Update to V1.0.2 or later version
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V4.0.1 affected by all CVEs |
Update to V4.0.1 or later version
|
|
Update to V4.2.0 or later version
|
|
Update to V4.1.0 or later version
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
|
Update to V4.2.0 or later version
|
All versions < V4.0.1 affected by all CVEs |
Update to V4.0.1 or later version
|
|
Update to V4.1.0 or later version
|
All versions < V15.1 affected by all CVEs |
Update to V15.1
|
|
Update to V7.0.6 or later version
|
All versions < V4.0 affected by all CVEs |
Upgrade to V4.0
|
|
Update to V3.0
|
All versions < V2.3 affected by all CVEs |
Contact your local Siemens representative or the Siemens customer support at https://w3.siemens.com/aspa_app/ to receive firmware version 2.3. Update to V2.3
|
All versions < V3.X.14 affected by all CVEs |
Update to V3.X.14 or later version
|
All versions < V6.0.7 affected by all CVEs |
Update to V6.0.7 or later version
|
All versions < V6.0.6 affected by all CVEs |
Update to V6.0.6 or later version
|
All versions < V7.0.2 affected by all CVEs |
Update to V7.0.2 or later version
|
All versions < V8.2 affected by all CVEs |
Update to V8.2
|
All versions < V4.2.1 affected by all CVEs |
Update to V4.2.1
|
All versions < V2.1 affected by all CVEs |
Update to V2.1 or later version
|
All versions < V2.1 affected by all CVEs |
Update to V2.1 or later version
|
All versions < V1.1.8 affected by all CVEs |
Update to V1.1.8 or later version
|
All versions < V1.1.1 affected by all CVEs |
Update to V1.1.1 or later version
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V2010 SP3 affected by all CVEs |
Update to V2010 SP3 or later version and apply BIOS and Microsoft Windows updates
|
All versions < V2010 SP3 affected by all CVEs |
Update to V2010 SP3 or later version and apply BIOS and Microsoft Windows updates
|
All versions < V2.0.0 affected by all CVEs |
Update to V2.0.0
|
All versions < V4.5 HF1 affected by all CVEs |
Update to V4.5 HF1
|
All versions < V1.4 SP1 HF5 affected by all CVEs |
Update to V1.4 SP1 HF5
|
All versions < V1.2 HF1 affected by all CVEs |
Update to V1.2 HF1
|
All versions < V4.7 SP6 HF3 affected by all CVEs |
Update to V4.7 SP6 HF3
|
All versions < V4.7 SP6 HF3 affected by all CVEs |
Update to V4.7 SP6 HF3
|
All versions < V4.7 HF27 affected by all CVEs |
Update to V4.7 HF27
|
All versions < V4.8 HF4 affected by all CVEs |
Update to V4.8 HF4
|
V4.7: All versions < V4.7 HF27 affected by all CVEs |
Update to V4.7 HF27
|
All versions < V4.8 HF4 affected by all CVEs |
Update to V4.8 HF4
|
All versions < V4.4 SP3 HF5 affected by all CVEs |
Update V4.4 SP3 HF5
|
All versions < V4.7 affected by all CVEs |
Update to latest version of V5.1 SP1
|
All versions affected by all CVEs |
Update to latest version of V5.1 SP1
|
All versions < V4.7 HF27 affected by all CVEs |
Update to V4.7 HF27
|
All versions < V4.8 HF4 affected by all CVEs |
Update to V4.8 HF4
|
All versions < V4.7 HF27 affected by all CVEs |
Update to V4.7 HF27
|
All versions < V4.8 HF4 affected by all CVEs |
Update to V4.8 HF4
|
All versions < V1.01 affected by all CVEs |
Update to V1.01
|
All versions < V4.5 SP6 HF2 affected by all CVEs |
Update to V4.5 SP6 HF2
|
All versions < V4.7 SP4 HF1 affected by all CVEs |
Update to V4.7 SP4 HF1.
|
All versions < V4.5 SP6 HF2 affected by all CVEs |
Update to V4.5 SP6 HF2
|
All versions < V4.7 SP4 HF1 affected by all CVEs |
Update to V4.7 SP4 HF1
|
All versions < V1.1.0 affected by all CVEs |
Update to V1.1.0
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions affected by all CVEs |
Currently no fix is planned
|
All versions < V1.2.0 affected by all CVEs |
Update to V1.2.0
|
All versions < V2.2.0 affected by all CVEs |
Update to V2.2.0
|
All versions < V14 SP1 affected by all CVEs |
Upgrade to V14 SP1
|
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:
Product-specific remediations or mitigations can be found in the section
Affected Products and Solution.
Please follow the General Security Recommendations.
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v4.0 Base Score | 7.1 |
CVSS v4.0 Vector | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-400: Uncontrolled Resource Consumption |
CVSS v3.1 Base Score | 6.5 |
CVSS v3.1 Vector | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v4.0 Base Score | 7.1 |
CVSS v4.0 Vector | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-400: Uncontrolled Resource Consumption |
For SIMATIC Teleservice Adapters (IE Basic, IE Standard, IE Advanced): migrate to a successor product within the SCALANCE M-800 family. For details refer to the "notice of discontinuation": https://support.industry.siemens.com/cs/ww/en/view/109781070.
V1.0 (2017-05-08): | Publication Date |
V1.1 (2017-06-13): | Added update information for SALANCE X-300/X408, X414, SITOP PSU8600/ UPS 1600 PROFINET and S7-400 |
V1.2 (2017-07-21): | Added update information for SCALANCE XM-400, SCALANCE XR-500, SIMATIC S7-400-H V6, SINAMICS S110, SINAMICS S120 and SINAMICS V90 |
V1.3 (2017-08-16): | Added update information for SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, and CP 1543SP-1, SIMATIC ET 200SP, SIMATIC S7-200 SMART, SINAMICS G130, G150, and S150, and SINUMERIK 828D; Adjusted update information for Development/Evaluation Kits |
V1.4 (2017-09-13): | Added update information for SCALANCE M-800 / S615 |
V1.5 (2017-10-09): | Detailed SIMATIC CP 1243-1, Added update information for SIMATIC CP 1243-1, 1243-1 IRC, SINAMICS DCM and added upgrade information for PN/PN Coupler |
V1.6 (2017-11-09): | Added upgrade and update information for Softnet PROFINET IO and SIMATC ET 200AL |
V1.7 (2017-11-23): | Added update information for SCALANCE X-200 and SIMATIC S7-400 PN/DP V6 Incl. F |
V1.8 (2018-01-18): | New advisory format, added update information for SIMOCODE pro V PROFINET |
V1.9 (2018-01-24): | Corrected information for SIMATIC CM 1542-1 and ET 200MP. Added solution for SINAMICS DCP, and S7-400 V7 PN/DP |
V2.0 (2018-02-22): | Refined ET 200MP product family; Added update information for ET 200MP IM155-5 PN ST |
V2.1 (2018-03-06): | Added update information for SCALANCE X-200IRT |
V2.2 (2018-05-03): | Added update information for SIMATIC CP 343-1 Std and CP 343-1 Lean |
V2.3 (2018-11-13): | Updated information for SINAMICS S120, SIMATIC ET 200SP (except IM155-6 PN ST), SIMATIC Panels |
V2.4 (2018-12-11): | Updated information for SIMATIC ET 200MP IM155-5 PN HF, SIRIUS ACT 3SU1 interface module PROFINET |
V2.5 (2018-12-13): | Corrected download links, update for CP 1243-1 not available, see mitigations |
V2.6 (2019-01-08): | Updated information for CP 1243-1 |
V2.7 (2019-10-08): | Renamed SIMATIC WinAC RTX 2010 incl. F to SIMATIC WinAC RTX (F) 2010 and updated information for SIMATIC WinAC RTX (F) 2010 |
V2.8 (2020-02-10): | SIPLUS devices now explicitly mentioned in the list of affected products |
V2.9 (2020-07-14): | Added SIMATIC TDC CP51M1 and CPU555 to the list of affected products |
V3.0 (2020-08-11): | Informed about successor product for SIMATIC Teleservice adapters. Added SIMATIC ET200ecoPN product variants (MLFB IDs) that are not affected |
V3.1 (2021-03-09): | Added ecoPN model (6ES7148-6JG00-0BB0) as not affected. Added MV400 and update information. Updated CWE classification for CVE-2017-2680 and CVE-2017-2681 |
V3.2 (2021-06-08): | Consolidated product names and added SIMATIC ET200SP IM155-6 PN HS to the advisory |
V3.3 (2021-10-12): | Clarified product name for SIMATIC NET CP 443-1 OPC UA and clarified affected ET200ecoPN models |
V3.4 (2022-02-08): | No remediation planned for SIMATIC CP 443-1 OPC UA; added more information to the advisory title; no remediation planned for ET200 devices |
V3.5 (2024-07-09): | Listed affected products individually instead of product families (e.g., for SIMATIC MV400, SIMATIC ET 200AL/MP/SP/pro IM families); added affected SIPLUS devices (e.g., SIPLUS ET 200xx IM) |
V3.6 (2024-09-10): | Clarified and updated impact of CVE-2017-2681 to the individual products; further consolidation in product list |