CVE-2023-35921
High
Description
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially crafted Ethernet frames sent to the devices. This could allow an unauthenticated remote attacker to cause a denial of service condition. The affected devices must be restarted manually.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSiemens Simatic Mv540 H Firmware
PublishedJul 11, 2023
First seenJul 11, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- siemens simatic_mv540_h_firmware3.3.4 or later
- siemens simatic_mv540_s_firmware3.3.4 or later
- siemens simatic_mv550_h_firmware3.3.4 or later
- siemens simatic_mv550_s_firmware3.3.4 or later
- siemens simatic_mv560_u_firmware3.3.4 or later
- siemens simatic_mv560_x_firmware3.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens simatic_mv540_h_firmware | v < 3.3.4 | 3.3.4 |
| siemens simatic_mv540_s_firmware | v < 3.3.4 | 3.3.4 |
| siemens simatic_mv550_h_firmware | v < 3.3.4 | 3.3.4 |
| siemens simatic_mv550_s_firmware | v < 3.3.4 | 3.3.4 |
| siemens simatic_mv560_u_firmware | v < 3.3.4 | 3.3.4 |
| siemens simatic_mv560_x_firmware | v < 3.3.4 | 3.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.