CVE-2021-37185

highPriorität · verfolgen · 29EPSS 0.021 · 81. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.06% (81st) EPSS

CVSS 7.1 · high

Is it mine?

88 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-26

A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC Drive Controller familysiemens_psirt
Update to V2.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773914/
BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)siemens_psirt
Update to V21.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759122/
BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)siemens_psirt
Update to V4.5.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793280/
BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)siemens_psirt
Update to V2.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/
BehobenSIMATIC S7-1500 Software Controllersiemens_psirt
Update to V21.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478528/
BehobenSIMATIC S7-PLCSIM Advancedsiemens_psirt
Update to V4.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805271/
BehobenSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)siemens_psirt
Update to V2.3.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817397/
BehobenTIM 1531 IRC (6GK7543-1MX00-0XE0)siemens_psirt
Update to V2.3.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817397/
BehobenSIMATIC Drive Controller familycisa_csaf_ot
Update to V2.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773914/
BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)cisa_csaf_ot
Update to V21.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759122/
BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)cisa_csaf_ot
Update to V4.5.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793280/
BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)cisa_csaf_ot
Update to V2.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/
BehobenSIMATIC S7-1500 Software Controllercisa_csaf_ot
Update to V21.9.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478528/
BehobenSIMATIC S7-PLCSIM Advancedcisa_csaf_ot
Update to V4.0 SP1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109805271/
BehobenSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)cisa_csaf_ot
Update to V2.3.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817397/
BehobenTIM 1531 IRC (6GK7543-1MX00-0XE0)cisa_csaf_ot
Update to V2.3.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817397/

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6–7.5

v2.07.1highAV:N/AC:M/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 6.9

v2.06mediumAV:N/AC:M/Au:N/C:N/I:N/A:C/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · productcert@siemens.com DEAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-672USCWE-672USCWE-672USCWE-672US

betroffene Produkte (88)

Betroffene Produkte und Versionsbereiche.

SIMATIC Drive Controller familyalle Versionencisa_csaf_otUS
SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)alle Versionencisa_csaf_otUS
SIMATIC S7-1200 CPU family (incl. SIPLUS variants)alle Versionencisa_csaf_otUS
SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)alle Versionencisa_csaf_otUS
SIMATIC S7-1500 Software Controlleralle Versionencisa_csaf_otUS
SIMATIC S7-PLCSIM Advancedalle Versionencisa_csaf_otUS
SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)alle Versionencisa_csaf_otUS
TIM 1531 IRC (6GK7543-1MX00-0XE0)alle Versionencisa_csaf_otUS
Siemens SIMATIC Drive Controller familyV2.9.2 → V2.9.4cisa_csaf_otUS
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)V21.9 → V21.9.4cisa_csaf_otUS
Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants)V4.5.0 → V4.5.2cisa_csaf_otUS
Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)V2.9.2 → V2.9.4cisa_csaf_otUS
Siemens SIMATIC S7-1500 Software ControllerV21.9 → V21.9.4cisa_csaf_otUS
Siemens SIMATIC S7-PLCSIM AdvancedV4.0| → V4.0_SP1cisa_csaf_otUS
Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)< V2.3.6cisa_csaf_otUS
Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0)< V2.3.6cisa_csaf_otUS
Siemens SIMATIC Drive Controller familyAll versions V2.9.2 → V2.9.4enisa_euvdEU
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)All versions V21.9 → V21.9.4enisa_euvdEU
Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants)All versions V4.5.0 → V4.5.2enisa_euvdEU
Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)All versions V2.9.2 → V2.9.4enisa_euvdEU

20 von 88 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-838121SSA-838121: Multiple Denial of Service Vulnerabilities in Industrial Products2022-02-08csaf · siemens_psirtDE
Affected SIMATIC firmware contains three vulnerabilities that could allow an unauthenticated attacker to perform a denial of service attack under certain conditions. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
ICSA-22-041-01Siemens SIMATIC Industrial Products (Update A)2022-02-08icsa · cisa_csaf_otUS
Affected SIMATIC firmware contains three vulnerabilities that could allow an unauthenticated attacker to perform a denial of service attack under certain conditions. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

veröffentlicht 2022-02-09geändert 2026-06-17

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan