#VU12761 Improper input validation in SIMATIC S7-400 H and SIMATIC S7-400


Published: 2018-05-16

Vulnerability identifier: #VU12761

Vulnerability risk: Low

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-4850

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
SIMATIC S7-400 H
Server applications / SCADA systems
SIMATIC S7-400
Hardware solutions / Firmware

Vendor: Siemens

Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper validation of S7 communication packets. A remote attacker can send a specially crafted S7 communication packet to a communication interface of the CPU and cause the core functionality of the CPU to crash.

Mitigation
Install update from vendor's website.

Vulnerable software versions

SIMATIC S7-400 H: 4.5

SIMATIC S7-400: 4.0 - 5.2

External links
http://cert-portal.siemens.com/productcert/pdf/ssa-914382.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.


Latest bulletins with this vulnerability


Denial of service in Siemens SIMATIC S7-400 CPUs