Denial of Service Vulnerability in Industrial Real-Time (IRT) Devices
Plan Patch7.5SSA-349422Oct 8, 2019
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A denial-of-service vulnerability in PROFINET devices allows an attacker with network access to disrupt real-time synchronization between controllers and distributed I/O modules. The vulnerability is triggered by sending crafted network packets that interfere with the timing mechanisms that coordinate plant operations. Siemens has released firmware updates for several product families (S7-300, S7-400, ET 200 series, SINAMICS drives, communication modules, and CNC controllers). However, legacy products including ET200ecoPN, ET200S, ET200M, SIMATIC PN/PN Coupler, SIMOTION, and older S7-400 V6 families will not receive patches and require compensating controls.
What this means
What could happen
An attacker on your network could disrupt real-time synchronization between PLCs and distributed I/O devices, causing loss of coordinated process control and potential operational disruptions in manufacturing or power distribution systems.
Who's at risk
Manufacturing facilities and power distribution operators using Siemens PROFINET-based automation. Specifically affects distributed I/O modules (ET200 series), PLCs (S7-300, S7-400, SIMATIC ET 200 variants), variable frequency drives (SINAMICS G/S series), motor control units (DCM, DCP), CNC machines (SINUMERIK), and industrial software controllers (SIMATIC WinAC, SIMOTION).
How it could be exploited
An attacker with network access to PROFINET (Ethernet-based real-time automation) can send crafted packets to ET200, SINAMICS, or SIMATIC devices to overwhelm their real-time synchronization mechanisms, breaking timing-critical coordination needed for plant operations.
Prerequisites
- Network access to PROFINET devices on your industrial network
- No authentication or credentials required to send network packets
Remotely exploitableNo authentication requiredLow complexity attackAffects real-time synchronization (timing-critical operations)Many products have no fix available (end-of-life hardware)
Exploitability
Low exploit probability (EPSS 0.5%)
Affected products (88)
62 with fix26 pending
ProductAffected VersionsFix Status
SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12All versionsNo fix yet
SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12All versionsNo fix yet
SIMATIC ET200ecoPN, 4AO U/I 4xM12All versionsNo fix yet
SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12All versionsNo fix yet
SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12All versionsNo fix yet
Remediation & Mitigation
0/15
Schedule — requires maintenance window
0/13Patching may require device reboot — plan for process interruption
SIMATIC ET 200pro IM 154-8 PN/DP CPU
HOTFIXUpdate SIMATIC ET 200pro IM 154-8 PN/DP CPU to firmware version 3.2.17 or later
SIMATIC ET 200S IM 151-8 PN/DP CPU
HOTFIXUpdate SIMATIC ET 200S IM 151-8 PN/DP CPU to firmware version 3.2.17 or later
SINAMICS DCM
HOTFIXUpdate SINAMICS DCM to firmware version 1.5 HF1 or later
SINAMICS DCP
HOTFIXUpdate SINAMICS DCP to firmware version 1.3 or later
SINUMERIK 828D
HOTFIXUpdate SINUMERIK 828D and 840D sl to firmware version 4.8 SP5 or later
SIMATIC WinAC RTX 2010
HOTFIXUpdate SIMATIC WinAC RTX 2010 to version 2010 SP3 or later
All products
HOTFIXUpdate SIMATIC S7-300 PN/DP CPUs to firmware version 3.2.17 or later
HOTFIXUpdate SIMATIC S7-400 PN/DP CPUs (V7) to firmware version 7.0.3 or later
HOTFIXUpdate SIMATIC ET 200MP IM 155-5 PN to firmware version 4.2.0 (HF variant) or 4.1.0 (ST variant) or later
HOTFIXUpdate SIMATIC ET 200SP IM 155-6 PN to firmware version 4.2.0 (HF variant) or 4.1.0 (ST variant) or later
HOTFIXUpdate SINAMICS drives (G120, G130, G150, S120, S150) to specified firmware hotfix versions (e.g., 4.7 HF29, 4.7 HF34)
HOTFIXUpdate SCALANCE X-200IRT to firmware version 5.4.2 or later
HOTFIXUpdate SIMATIC CP 1604/1616 communication modules to firmware version 2.8 or later
Long-term hardening
0/2SIMOTION
HARDENINGFor unfixable products (ET200ecoPN, ET200S, ET200M, PN/PN Coupler, SIMOTION, and legacy S7-400 V6), implement network segmentation to restrict PROFINET access to trusted engineering workstations and supervisory systems only
All products
HARDENINGMonitor PROFINET traffic for anomalous packet patterns or excessive requests that may indicate denial-of-service attempts
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2471426c-dfdc-4b71-9c14-767caa9ab5ff