PT-2018-2566 · Siemens · Simatic S7-400 Cpu 416-2 Dp V7+14

Published 2018-11-13 · Updated 2023-05-09 · CVE-2018-16556

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC S7-400 CPU 412-1 DP V7 (All versions) SIMATIC S7-400 CPU 412-2 DP V7 (All versions) SIMATIC S7-400 CPU 412-2 PN V7 (All versions < V7.0.3) SIMATIC S7-400 CPU 414-2 DP V7 (All versions) SIMATIC S7-400 CPU 414-3 DP V7 (All versions) SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3) SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3) SIMATIC S7-400 CPU 416-2 DP V7 (All versions) SIMATIC S7-400 CPU 416-3 DP V7 (All versions) SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3) SIMATIC S7-400 CPU 416F-2 DP V7 (All versions) SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3) SIMATIC S7-400 CPU 417-4 DP V7 (All versions) SIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants) (All versions) SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.9) SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions) SIMATIC S7-410 CPU family (incl. SIPLUS variants) (All versions < V8.2.1) SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3) SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3) SIPLUS S7-400 CPU 416-3 V7 (All versions) SIPLUS S7-400 CPU 417-4 V7 (All versions)

Description The issue is related to errors in input validation by the Ethernet, PROFIBUS, and MPI interfaces, which could allow a remote attacker to cause a denial of service condition by sending specially crafted packets to port 102/tcp. This can cause the affected devices to go into defect mode, requiring a manual reboot to resume normal operation. No user interaction or privileges are required for exploitation.

Recommendations For SIMATIC S7-400 CPU 412-1 DP V7 and other affected versions with no specified fix, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For SIMATIC S7-400 CPU 414-3 PN/DP V7 and SIPLUS S7-400 CPU 414-3 PN/DP V7, consider updating to version V7.0.3 or later. For SIMATIC S7-400 H V6 CPU family, consider updating to version V6.0.9 or later. For SIMATIC S7-410 CPU family, consider updating to version V8.2.1 or later. As a temporary workaround, consider restricting access to port 102/tcp via Ethernet interface, via PROFIBUS, or via Multi Point Interfaces (MPI) to minimize the risk of exploitation.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01021

CVE-2018-16556

Affected Products

Simatic S7-400 Cpu 412-1 Dp V7

Simatic S7-400 Cpu 412-2 Pn V7

Simatic S7-400 Cpu 414-2 Dp V7

Simatic S7-400 Cpu 414F-3 Pn/Dp V7

Simatic S7-400 Cpu 416-2 Dp V7

Simatic S7-400 Cpu 416-3 Pn/Dp V7

Simatic S7-400 Cpu 417-4 Dp V7

Simatic S7-400 H V4.5

Simatic S7-400 V6

Simatic S7-400 Pn/Dp V6

Simatic S7-410

Siplus S7-400 Cpu 414-3 Pn/Dp V7

Siplus S7-400 Cpu 416-3 Pn/Dp V7

Siplus S7-400 Cpu 416-3 V7

Siplus S7-400 Cpu 417-4 V7

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-16556 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-113131.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16556 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01021 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-317-02 · Note