CVE-2022-25622
Medium
Description
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.
SeverityMedium
CVSS5.3
Exploit probability—
ProductSiemens Simatic Cfu Diq Firmware
PublishedApr 12, 2022
First seenApr 12, 2022
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- siemens simatic_s7-1500_cpu_firmware2.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens simatic_cfu_diq_firmware | No range specified | — |
| siemens simatic_cfu_pa_firmware | No range specified | — |
| siemens simatic_s7-300_cpu_firmware | No range specified | — |
| siemens simatic_s7-400h_v6_firmware | No range specified | — |
| siemens simatic_s7-400_pn\/dp_v7_firmware | No range specified | — |
| siemens simatic_s7-410_v8_firmware | No range specified | — |
| siemens simatic_s7-410_v10_firmware | No range specified | — |
| siemens simatic_s7-1500_cpu_firmware | v < 2.0.0 | 2.0.0 |
| siemens simatic_tdc_cp51m1_firmware | No range specified | — |
| siemens simatic_tdc_cpu555_firmware | No range specified | — |
| siemens simatic_winac_rtx_firmware | No range specified | — |
| siemens simit_simulation_platform | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.