PT-2020-14628 · Siemens · Sinumerik 840D Sl+2

Published 2020-11-12 · Updated 2022-12-06 · CVE-2020-15783

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions) SIMATIC TDC CPU555 (All versions) SINUMERIK 840D sl (All versions)

Description A Denial-of-Service issue has been identified, which can be triggered by sending multiple specially crafted packets to the affected devices on port 102. This results in a denial of service, requiring a cold restart to recover.

Recommendations For SIMATIC S7-300 CPU family, consider restricting access to port 102 until a fix is available. For SIMATIC TDC CPU555, avoid using the service on port 102 until the issue is resolved. For SINUMERIK 840D sl, limit network exposure to minimize the risk of exploitation on port 102. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-15783

Affected Products

Simatic S7-300 Cpu

Simatic Tdc Cpu555

Sinumerik 840D Sl

References · 3

• https://cert-portal.siemens.com/productcert/pdf/ssa-492828.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15783 · Security Note
• https://t.me/cibsecurity/16264 · Telegram Post