PT-2016-3430 · Siemens · Siplus Net Cp 1543-1+1

Published 2016-11-18 · Updated 2025-01-22 · CVE-2016-8562

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC CP 1543-1 versions prior to V2.0.28 SIPLUS NET CP 1543-1 versions prior to V2.0.28

Description A vulnerability has been identified in the software, related to improper privilege management and insufficient input validation. Under special conditions, it is possible to write SNMP variables on port 161/udp, which should be read-only and only configured with TIA-Portal. This could reduce availability or cause a denial-of-service. An attacker could exploit this vulnerability by sending specially crafted packets to port 161/udp, potentially leading to a denial-of-service.

Recommendations For Siemens SIMATIC CP 1543-1 versions prior to V2.0.28, update to version V2.0.28 or later to resolve the issue. For SIPLUS NET CP 1543-1 versions prior to V2.0.28, update to version V2.0.28 or later to resolve the issue. As a temporary workaround, consider restricting access to port 161/udp to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-04011

CVE-2016-8562

Affected Products

Simatic Cp 1543Sp-1

Siplus Net Cp 1543-1

References · 9

• https://cert-portal.siemens.com/productcert/pdf/ssa-672373.pdf · Vendor Advisory
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-672373.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8562 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04011 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8562 · Security Note
• http://securityfocus.com/bid/94436 · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8562 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-327-01 · Note