|2018-03-20||Other||Siemens||Siemens ProductCERT reported this vulnerability to NCCIC.||N/A||CVE-2018-4843 ||N/A||N/A||N/A|
# Siemens SIMATIC, SINUMERIK, and PROFINET IO
### VULNERABLE VENDOR
### VULNERABLE PRODUCT
SIMATIC, SINUMERIK, and PROFINET IO
Siemens ProductCERT reported this vulnerability to NCCIC.
### AFFECTED PRODUCTS
Siemens reports that the vulnerability affects the following products:
SIMATIC CP 343-1 Advanced: All versions,
SIMATIC CP 343-1 Standard: All versions,
SIMATIC CP 443-1 Advanced: All versions,
SIMATIC CP 443-1 Standard: All versions,
SIMATIC S7-1500 Software Controller incl. F: All versions prior to V1.7.0,
SIMATIC S7-1500 incl. F: All versions prior to V1.7.0,
SIMATIC S7-300 incl. F and T: All versions,
SIMATIC S7-400 H V6: All versions,
SIMATIC S7-400 PN/DP V6 Incl. F: All versions prior to V6.0.7,
SIMATIC S7-400 PN/DP V7 Incl. F: All versions,
SIMATIC S7-410: All versions prior to V8.1,
SIMATIC WinAC RTX 2010 incl. F: All versions,
SINUMERIK 828D: All versions, and
Softnet PROFINET IO for PC-based Windows systems: All versions
Successful exploitation of this vulnerability could result in a denial-of-service condition requiring a manual restart to recover the system.
### VULNERABILITY OVERVIEW
IMPROPER INPUT VALIDATION CWE-20
Responding to a PROFINET DCP request with a specially crafted PROFINET DCP packet could result in a denial-of-service condition of the requesting system.
This vulnerability could be exploited if the attacker is located on the same Ethernet segment (OSI Layer 2) as the targeted device.
CVE-2018-4843 has been assigned to this vulnerability.
A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater Systems.
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany
Siemens has provided the following updates for mitigations:
SIMATIC S7-1500 Software Controller incl. F: Update to V1.8.5 or newer, which can be located here:
SIMATIC S7-1500 incl. F: Update to V1.8.5 or newer, which can be located here:
SIMATIC S7-400 PN/DP V6 Incl. F: Update to V6.0.7, which can be located here:
SIMATIC S7-410: Update to V8.1, which can be located here:
For all other affected products, Siemens has identified the following specific workarounds and mitigations that users can apply to reduce the risk, refer to:
Apply cell protection concept.
Use VPN for protecting network communication between cells.
Additional information is available at:
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to run the devices in a protected IT environment, Siemens particularly recommends to configure the environment according to Siemens’ operational guidelines for industrial security, and to follow the recommendations in the product manuals. Additional information on industrial security by Siemens can be found at:
For more information on this vulnerability and associated software updates, please see Siemens security notification SSA-592007 on their website: