CVE-2019-13940
Description
A vulnerability has been identified in SIMATIC ET 200pro IM154-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8F PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200pro IM154-8FX PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200S IM151-8 PN/DP CPU (All versions < V3.X.17), SIMATIC ET 200S IM151-8F PN/DP CPU (All versions < V3.X.17), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.1), SIMATIC S7-300 CPU 314C-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 315-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 315F-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 315T-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317F-2 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317T-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 317TF-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 319-3 PN/DP (All versions < V3.X.17), SIMATIC S7-300 CPU 319F-3 PN/DP (All versions < V3.X.17), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC WinAC RTX 2010 (All versions), SIMATIC WinAC RTX F 2010 (All versions), SIPLUS ET 200S IM151-8 PN/DP CPU (All versions < V3.X.17), SIPLUS ET 200S IM151-8F PN/DP CPU (All versions < V3.X.17), SIPLUS S7-300 CPU 314C-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 315-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 315F-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 317-2 PN/DP (All versions < V3.X.17), SIPLUS S7-300 CPU 317F-2 PN/DP (All versions < V3.X.17). Affected devices contain a vulnerability that could cause a denial of service condition of the web server by sending specially crafted HTTP requests to ports 80/tcp and 443/tcp. Beyond the web service, no other functions or interfaces are affected by the denial of service condition.
How to fix
- siemens s7-1200_cpu_1211c_firmware4.1 or later
- siemens s7-1200_cpu_1212c_firmware4.1 or later
- siemens s7-1200_cpu_1214c_firmware4.1 or later
- siemens s7-1200_cpu_1215c_firmware4.1 or later
- siemens s7-1200_cpu_1217c_firmware4.1 or later
- siemens s7-1200_cpu_1212fc_firmware4.1 or later
- siemens s7-1200_cpu_1214fc_firmware4.1 or later
- siemens s7-1200_cpu_1215fc_firmware4.1 or later
- siemens siplus_s7-1200_firmware4.1 or later
- siemens siplus_cpu_1211c_firmware4.1 or later
- siemens siplus_cpu_1212c_firmware4.1 or later
- siemens siplus_cpu_1215c_firmware4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens s7-1200_cpu_1211c_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1212c_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1214c_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1215c_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1217c_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1212fc_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1214fc_firmware | v < 4.1 | 4.1 |
| siemens s7-1200_cpu_1215fc_firmware | v < 4.1 | 4.1 |
| siemens siplus_s7-1200_firmware | v < 4.1 | 4.1 |
| siemens siplus_cpu_1211c_firmware | v < 4.1 | 4.1 |
| siemens siplus_cpu_1212c_firmware | v < 4.1 | 4.1 |
| siemens siplus_cpu_1214c_firmware | v ≤ 4.1 | — |
| siemens siplus_cpu_1215c_firmware | v < 4.1 | 4.1 |
| siemens simatic_s7-300_cpu_319-3_pn\/dp_firmware | No range specified | — |
| siemens simatic_s7-300_cpu_315-2dp_firmware | No range specified | — |
| siemens simatic_s7-300_cpu_315-2_pn\/dp_firmware | No range specified | — |
| siemens simatic_s7-300_cpu_317-2_dp_firmware | No range specified | — |
| siemens simatic_s7-300_cpu_317-2_pn\/dp_firmware | No range specified | — |
| siemens siplus_s7-300_cpu_314_firmware | No range specified | — |
| siemens siplus_s7-300_cpu_315-2_dp_firmware | No range specified | — |
| siemens siplus_s7-300_cpu_315-2_pn\/dp_firmware | No range specified | — |
| siemens siplus_s7-300_cpu_317-2_pn\/dp_firmware | No range specified | — |
| siemens simatic_s7-400_pn\/dp_cpu_firmware | No range specified | — |
| siemens simatic_winac_rtx_\(f\)_2010 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.