Vulnerability · Published Sep 14, 2021 · Assigned by siemens
CVE-2021-33737
High 7.5
In plain English
A high-severity memory corruption in SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Official description
A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 ERPC (All versions), SIMATIC CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 Advanced (All versions < V3.3), SIPLUS NET CP 443-1 (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (All versions < V3.3). Sending a specially crafted packet to port 102/tcp of an affected device could cause a denial of service condition. A restart is needed to restore normal operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC CP 343-1 (incl. SIPLUS variants) | All versions |
| Siemens | SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) | All versions |
| Siemens | SIMATIC CP 343-1 ERPC | All versions |
| Siemens | SIMATIC CP 343-1 Lean (incl. SIPLUS variants) | All versions |
| Siemens | SIMATIC CP 443-1 | All versions < V3.3 |
| Siemens | SIMATIC CP 443-1 | All versions < V3.3 |
| Siemens | SIMATIC CP 443-1 Advanced | All versions < V3.3 |
| Siemens | SIPLUS NET CP 443-1 | All versions < V3.3 |
| Siemens | SIPLUS NET CP 443-1 Advanced | All versions < V3.3 |
Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:U/RC:C