CVE-2011-20002: Authentication Bypass by Capture-replay

A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family incl. SIPLUS variants All versions V2.0.2, SIMATIC S7-1200 CPU V2 family incl. SIPLUS variants All versions V2.0.2. Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This...

CVE-2011-20001: Improper Input Validation

A vulnerability has been identified in SIMATIC S7-1200 CPU V1 family incl. SIPLUS variants All versions V2.0.3, SIMATIC S7-1200 CPU V2 family incl. SIPLUS variants All versions V2.0.3. The web server interface of affected devices improperly processes incoming malformed HTTP traffic at high rate...

EUVD-2021-23746

Malware in sbrugna...

CVE-2025-24811

CVE-2025-24811 affects a broad range of SIMATIC S7-1200 and SIPLUS S7-1200 CPUs (e.g., 1211C/1212C/1214C/1215C/1217C and SIPLUS variants) where certain specially crafted packets sent to port 80/tcp are not processed correctly. This leads to an unauthenticated denial of service in the device. The ...

CVE-2025-24811: Improper Resource Shutdown or Release

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0, SIMATIC S7-1200 CPU 1212C AC/DC/Rly 6ES7212-1BE40-0XB0, SIMATIC S7-1200 CPU 1212C DC/DC/DC...

CVE-2024-47100: Cross-Site Request Forgery (CSRF)

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0, SIMATIC S7-1200 CPU 1212C AC/DC/Rly 6ES7212-1BE40-0XB0, SIMATIC S7-1200 CPU 1212C DC/DC/DC...

Siemens SIMATIC Industrial Products Operation On a Resource After Expiration or Release (CVE-2021-37185)

A vulnerability has been identified in SIMATIC Drive Controller family All versions = V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 V4.0 SP1, SIPLUS TIM 1531 IRC All versions V2.3.6, TIM 1531 IRC All versions V2.3.6. An unauthenticated attacker could cause a denial- of-service condition in a PL...

CVE-2021-37205

CVE-2021-37205 affects Siemens SIMATIC Drive Controller family and related devices (Drive Controller, ET 200SP Open Controller CPU 1515SP PC2, S7-1200/1500 families, S7-PLCSIM Advanced, TIM 1531 IRC). The issue is a memory-management flaw (MISSING RELEASE OF MEMORY AFTER EFFECTIVE LIFETIME) that ...

Siemens S7-1200 and S7-200 SMART CPUs Exposed Dangerous Method or Function (CVE-2019-13945)

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions, SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants All versions with Function State FS 11, SIMATIC S7-200 SMART CPU CR20s 6E...

PT-2021-21548

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family incl. SIPLUS variants version 4.5.0 Description A vulnerability has been identified where affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an...

CVE-2021-37172: Improper Authentication

A vulnerability has been identified in SIMATIC S7-1200 CPU family incl. SIPLUS variants V4.5.0. Affected devices fail to authenticate against configured passwords when provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication an...

PT-2019-4317

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family incl. SIPLUS variants versions prior to V4.x SIMATIC S7-1200 CPU family V4.x incl. SIPLUS variants versions with Function State FS 11 SIMATIC S7-200 SMART CPU CR20s 6ES7 288-1CR20-0AA1 versions = V2.3.0 and Function...

CVE-2018-13800

Siemens SIMATIC S7-1200 CPU Family Version 4 (all versions before 4.2.3) is affected by a Cross-Site Request Forgery (CSRF) vulnerability in the web interface. Exploitation requires a legitimate, authenticated user to click a malicious link, enabling an attacker to trigger actions within the auth...

PT-2018-12195

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family versions prior to V4.2.3 Description A security issue has been identified that could allow a Cross-Site Request Forgery CSRF attack through the web interface. This attack requires user interaction by a legitimate use...

CVE-2018-13800: Cross-Site Request Forgery (CSRF)

A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 All versions V4.2.3. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a...

CVE-2016-2846: Undefined Security Weakness

Siemens SIMATIC S7-1200 CPU devices before 4.0 allow remote attackers to bypass a "user program block" protection mechanism via unspecified vectors...

PT-2016-5235

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1200 CPU devices versions prior to 4.0 Description The issue allows remote attackers to bypass a user program block protection mechanism. Recommendations For versions prior to 4.0, update to version 4.0 or later to resolve t...

CVE-2015-5698: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

PT-2015-1327

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-1200 CPU devices with firmware prior to 4.1 Description The issue allows a remote attacker to redirect users to arbitrary web sites, potentially leading to phishing attacks. This is achieved through an open redirect...

CVE-2015-1048: Undefined Security Weakness

Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...