PT-2017-3762 · Siemens · Profinet Dcp

Published 2017-05-08 · Updated 2024-09-10 · CVE-2017-2680

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Siemens PROFINET DCP (affected versions not specified)

Description: The issue is related to insufficient input validation in the PROFINET DCP software, which can be exploited by an attacker using specially crafted PROFINET DCP broadcast packets. This could cause a denial of service condition on affected products within a local Ethernet segment (Layer 2), requiring human interaction to recover the systems. It is noted that PROFIBUS interfaces are not affected.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2019-00515

CVE-2017-2680

Affected Products

Profinet Dcp

References · 16

• https://osv.dev/vulnerability/CVE-2017-2680 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-284673.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-546832.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00515 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2680 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-293562.html · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-023-02 · Note
• http://securitytracker.com/id/1038463 · Note
• https://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284673.pdf · Note
• https://t.me/cvenotify/85510 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-546832.html · Note
• http://securityfocus.com/bid/98369 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-129-02 · Note
• https://cert-portal.siemens.com/productcert/html/ssa-284673.html · Note