Multiple Vulnerabilities in Embedded FTP Server of SIMATIC CP Modules

An attacker with network access could read sensitive data from the communication processor or execute commands on it, potentially disrupting network communications for SIMATIC automation systems or accessing engineering data and credentials stored on the device.

Water authorities, electric utilities, and other critical infrastructure operators using SIEMENS SIMATIC CP 1543-1 or CP 1545-1 communication processors in their automation networks. These devices are commonly used to connect programmable logic controllers (PLCs) to industrial networks or remote monitoring systems. Engineers and automation technicians who manage these systems are also affected by the risk of credential theft.

An attacker on the network connects to the FTP server port on the CP module using valid credentials (escalated from low-privilege access). The attacker sends specially crafted FTP commands that trigger the out-of-bounds read or use-after-free condition, allowing code execution or information disclosure. No special network position or system knowledge is required beyond basic FTP client usage.