The vulnerability of microprogrammed software in programmable logic controllers from SIMATIC, related to insufficient validation of input data, allows a malicious actor to trigger malfunctions during maintenance operations.

🗓️ 23 Apr 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

SIMATIC PLCs have input data validation flaws enabling maintenance malfunctions from crafted UDP packets to port 161.

Reporter	Title	Published	Views	Family All 20
Tenable Nessus	Siemens SIMOCODE Pro V EIP < 1.0.2 DoS	10 Apr 201900:00	–	nessus
Tenable Nessus	Siemens Simatic Unspecified Vulnerability	8 Nov 201900:00	–	nessus
Tenable Nessus	Siemens Industrial Products Improper Input Validation (CVE-2017-12741)	7 Feb 202200:00	–	nessus
ATTACKERKB	CVE-2017-12741	26 Dec 201704:29	–	attackerkb
CNVD	Multiple Siemens Products Denial of Service Vulnerabilities	29 Nov 201700:00	–	cnvd
CVE	CVE-2017-12741	26 Dec 201704:00	–	cve
Cvelist	CVE-2017-12741	26 Dec 201704:00	–	cvelist
EUVD	EUVD-2017-4280	7 Oct 202500:30	–	euvd
ICS	Siemens Industrial Products (Update S)	23 Nov 201700:00	–	ics
ICS	Siemens Industrial Products (Update A)	5 Dec 201700:00	–	ics

Vulners

Node

siemens_ag simatic_et_200sp_im155-6_pn_hfRange<4.2.0

OR

siemens_ag simatic_s7-1200Range<4.2.3

OR

siemens_ag simatic_s7-200_smartRange<2.03.01

OR

siemens_ag simatic_s7-400-hRange<6.0.8

OR

siemens_ag simatic_s7-400_pn/dpRange<7.0.2

OR

siemens_ag simatic_s7-410Range<8.2.1

OR

siemens_ag simatic_s7-300Range<3.x.16

OR

siemens_ag simatic_s7-1500Range<2.0

OR

siemens_ag simatic_s7-1500_software_controllerRange<2.0

OR

siemens_ag simatic_et_200mp_im155-5_pn_baRange<4.0.2

OR

siemens_ag simatic_et_200mp_im155-5_pn_stRange<4.1

OR

siemens_ag simatic_et_200mp_im155-5_pn_hfRange<4.2

OR

siemens_ag sinamics_v90_w._pnRange<1.02

OR

siemens_ag sinumerik_840d_slRange<4.8

OR

siemens_ag simocode_pro_v_profinetRange<2.1.1

OR

siemens_ag simatic_s7-400_pnRange<6.0.6

OR

siemens_ag simatic_et_200sp_im_155-6_pn_haRange<1.1.0

OR

siemens_ag development/evaluation_kits_for_profinet_io_ek-ertec_200pRange<4.5

OR

siemens_ag development/evaluation_kits_for_profinet_io_ek-ertec_200Range<4.5

OR

siemens_ag simatic_pn/pn_couplerRange<2.1.0

OR

siemens_ag simocode_pro_v_eipRange<1.0.2

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-346262.pdf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-12741
web	www.web.nvd.nist.gov/view/vuln/detail

01 Jul 2021 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.8

EPSS0.05261

simatic programmable logic maintenance malfunctions crafted network packets port 161