OTPulse
FeedAboutContact

ICSA-19-253-05 Siemens SIMATIC TDC CP51M1

Plan Patch7.5ICS-CERT ICSA-19-253-05Sep 10, 2019
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

SIMATIC TDC CP51M1 terminal device controller modules prior to version 1.1.7 contain an input validation flaw (CWE-20) in UDP packet handling. A remote attacker can send malformed UDP packets to the affected device, causing a denial of service condition that crashes the module and interrupts control logic execution. The module must be restarted to restore functionality. No authentication is required to exploit this vulnerability.

What this means
What could happen
An attacker with network access could send specially crafted UDP packets to crash the TDC CP51M1 module, disrupting control logic and causing loss of availability in your process control system until the device is restarted.
Who's at risk
Organizations running Siemens SIMATIC TDC CP51M1 modules in process control environments, including water treatment, wastewater, and power generation facilities that rely on this terminal device controller for discrete control logic.
How it could be exploited
An attacker sends malformed UDP packets to the affected TDC CP51M1 module over the network. The module fails to properly validate the UDP input (CWE-20), causing a denial of service condition that stops the module from processing control functions.
Prerequisites
  • Network access to the TDC CP51M1 module on UDP ports
  • No authentication required
  • The module must be reachable from the attacker's network segment
remotely exploitableno authentication requiredlow complexityaffects availability of control systemaffects process control logic
Exploitability
Low exploit probability (EPSS 0.8%)
Affected products (1)
ProductAffected VersionsFix Status
SIMATIC TDC CP51M1<V1.1.7v1.1.7
Remediation & Mitigation
0/5
Do now
0/2
WORKAROUNDRestrict network access to the TDC CP51M1 module using firewall rules to limit which systems can communicate with it
WORKAROUNDRestrict or disable UDP communication to the TDC CP51M1 if not required by your application
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate SIMATIC TDC CP51M1 to firmware version 1.1.7 or later
Long-term hardening
0/2
HARDENINGImplement network segmentation to isolate your control system network from the business network behind a firewall
HARDENINGFollow Siemens operational guidelines for industrial security and implement defense-in-depth layered controls
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/fcc4c4e6-4f4e-4ce5-9d9c-e98d0cc7284c