Vulnerability · Published Nov 12, 2020 · Assigned by siemens

CVE-2020-15783

High 7.5

In plain English

A high-severity uncontrolled resource consumption in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.7%top 23.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC TDC CPU555 (All versions), SINUMERIK 840D sl (All versions). Sending multiple specially crafted packets to the affected devices could cause a Denial-of-Service on port 102. A cold restart is required to recover the service.

Affected products (as reported)

Vendor	Product	Versions
Siemens	SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants)	All versions
Siemens	SIMATIC TDC CPU555	All versions
Siemens	SINUMERIK 840D sl	All versions

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://cert-portal.siemens.com/productcert/pdf/ssa-492828.pdf x_refsource_MISC