Improper input validation in Siemens products - CVE-2017-12741
Published: December 5, 2017 / Updated: December 6, 2017
Vulnerability identifier: #VU9545
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12741
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to an error when processing malicious packets. A remote attacker can send specially crafted packets via UDP port 161 and cause the device to crash or become unresponsive.
Successful exploitation of the vulnerability results in denial of service.
Affected software
SIMATIC ET 200SP
SINAMICS S110
SINAMICS S120
SINAMICS G130
SINAMICS V90
SINUMERIK 840D
SIMATIC Compact Field Unit
SIMATIC PN/PN Coupler
SIMOCODE pro V PROFINET
SINAMICS DCP
SINAMICS DCM
SIMATIC WinAC RTX 2010
SIMATIC ET 200S
SIMATIC ET 200ecoPN
Development/Evaluation Kits for PROFINET IO
SIMATIC ET 200AL
SIMATIC ET 200pro
SIMATIC ET 200M
SIMATIC ET 200MP
SIMATIC S7-400
SIMATIC S7-1500 CPU
SIMATIC S7-1200
SIMATIC S7-300
SIMATIC S7-200 Smart
SINAMICS S150
SINAMICS G120
SIMOTION Firmware
SIMATIC S7-410
SINAMICS S110
SINAMICS S120
SINAMICS G130
SINAMICS V90
SINUMERIK 840D
SIMATIC Compact Field Unit
SIMATIC PN/PN Coupler
SIMOCODE pro V PROFINET
SINAMICS DCP
SINAMICS DCM
SIMATIC WinAC RTX 2010
SIMATIC ET 200S
SIMATIC ET 200ecoPN
Development/Evaluation Kits for PROFINET IO
SIMATIC ET 200AL
SIMATIC ET 200pro
SIMATIC ET 200M
SIMATIC ET 200MP
SIMATIC S7-400
SIMATIC S7-1500 CPU
SIMATIC S7-1200
SIMATIC S7-300
SIMATIC S7-200 Smart
SINAMICS S150
SINAMICS G120
SIMOTION Firmware
SIMATIC S7-410
How to mitigate CVE-2017-12741
Install update from vendor's website.