PT-2012-4441 · Siemens · Simatic S7-400 Pn Cpu

Published 2012-07-31 · Updated 2020-04-13 · CVE-2012-3017

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC S7-400 PN CPU devices with firmware 5.x

Description The issue allows remote attackers to cause a denial of service, resulting in a defect-mode transition and service outage. This can be achieved via malformed HTTP traffic or malformed IP packets.

Recommendations For firmware 5.x, apply the necessary configuration changes to restrict malformed HTTP traffic and IP packets to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2012-3017

Affected Products

Simatic S7-400 Pn Cpu

References · 4

• http://siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-617264.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3017 · Security Note
• http://us-cert.gov/control_systems/pdf/ICSA-12-212-02.pdf · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-617264.pdf · Note