CVE-2019-18336
highpriority · track · 31EPSS 0.017 · 77 %ileEURUUSEPSS · scored 2026-10-22
A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (All versions < V1.1.8), SIMATIC TDC CPU555 (All versions < V1.1.1), SINUMERIK 840D sl (All versions < V4.8.6), SINUMERIK 840D sl (All versions < V4.94). Specially crafted packets sent to port 102/tcp (Profinet) could cause the affected device to go into defect mode. A restart is required in order to recover the system. Successful exploitation requires an attacker to have network access to port 102/tcp, with no authentication. No user interation is required. At the time of advisory publication no public exploitation of this security vulnerability was known.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSIMATIC S7-300 CPU family (incl.'related ET200 CPUs and SIPLUS variants)cisa_csaf_ot
Update to V3.X.17
- FixedSIMATIC TDC CP51M1cisa_csaf_ot
Update to V1.1.8
- FixedSIMATIC TDC CPU555cisa_csaf_ot
Update to V1.1.1
- FixedSINUMERIK 840D slcisa_csaf_ot
Update to V4.8.6
- MitigationSIMATIC S7-300 CPU family (incl.'related ET200 CPUs and SIPLUS variants)cisa_csaf_ot
Make sure that access to port 102/tcp is restricted e.g.'with an external firewall.
- MitigationSIMATIC TDC CP51M1cisa_csaf_ot
Make sure that access to port 102/tcp is restricted e.g.'with an external firewall.
- MitigationSIMATIC TDC CPU555cisa_csaf_ot
Make sure that access to port 102/tcp is restricted e.g.'with an external firewall.
- MitigationSINUMERIK 840D slcisa_csaf_ot
Make sure that access to port 102/tcp is restricted e.g.'with an external firewall.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (30)
Products and version ranges known to be affected.
- siemens simatic s7-300 cpu 312 ifm firmware< 3.3.17nvdUScpe:2.3:o:siemens:simatic_s7-300_cpu_312_ifm_firmware:*:*:*:*:*:*:*:*
- siemens simatic s7-300 cpu 313 firmware< 3.3.17nvdUScpe:2.3:o:siemens:simatic_s7-300_cpu_313_firmware:*:*:*:*:*:*:*:*
- siemens simatic s7-300 cpu 314 firmware< 3.3.17nvdUScpe:2.3:o:siemens:simatic_s7-300_cpu_314_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-20-070-02Siemens SIMATIC S7-300 CPUs and SINUMERIK Controller over Profinet (Update A)2020-03-10icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- http://www.nsfocus.net/vulndb/46130cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-508982.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-18336cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-20-070-02cnnvd
- https://vigilance.fr/vulnerability/Siemens-SIMATIC-S7-300-denial-of-service-31764cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-508982.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-508982.pdfVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan