SSA-784849: Direct Memory Access Vulnerabilities in SIMATIC CP Devices
Several SIMATIC CP devices contain direct memory access vulnerabilities that could allow an attacker to execute code, access the PROFINET network without restrictions or perform denial of service attacks. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-37195US | — | — | ||
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 16… | ||||
| CVE-2023-37194US | — | — | ||
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 16… | ||||
references
External citations — patches, advisories, analysis.
- SSA-784849: Direct Memory Access Vulnerabilities in SIMATIC CP Devices - CSAF Versionself
- SSA-784849: Direct Memory Access Vulnerabilities in SIMATIC CP Devices - HTML Versionself
- SSA-784849: Direct Memory Access Vulnerabilities in SIMATIC CP Devices - PDF Versionself
- SSA-784849: Direct Memory Access Vulnerabilities in SIMATIC CP Devices - TXT Versionself
remediations (20)
- MitigationSIMATIC CP 1604 (6GK1160-4AA01)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1604 (6GK1160-4AA01)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1616 (6GK1161-6AA02)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1616 (6GK1161-6AA02)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1623 (6GK1162-3AA00)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1623 (6GK1162-3AA00)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1626 (6GK1162-6AA01)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1626 (6GK1162-6AA01)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1628 (6GK1162-8AA00)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- MitigationSIMATIC CP 1628 (6GK1162-8AA00)
Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.
- No fix plannedSIMATIC CP 1604 (6GK1160-4AA01)
Currently no fix is planned
- No fix plannedSIMATIC CP 1604 (6GK1160-4AA01)
Currently no fix is planned
- No fix plannedSIMATIC CP 1616 (6GK1161-6AA02)
Currently no fix is planned
- No fix plannedSIMATIC CP 1616 (6GK1161-6AA02)
Currently no fix is planned
- No fix plannedSIMATIC CP 1623 (6GK1162-3AA00)
Currently no fix is planned
- No fix plannedSIMATIC CP 1623 (6GK1162-3AA00)
Currently no fix is planned
- No fix plannedSIMATIC CP 1626 (6GK1162-6AA01)
Currently no fix is planned
- No fix plannedSIMATIC CP 1626 (6GK1162-6AA01)
Currently no fix is planned
- No fix plannedSIMATIC CP 1628 (6GK1162-8AA00)
Currently no fix is planned
- No fix plannedSIMATIC CP 1628 (6GK1162-8AA00)
Currently no fix is planned
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan