Read the docs
TI-2018-11876 Aliases CVE-2018-16556GHSA-h69h-mwxm-xg4v

Improper input validation in Siemens SIMATIC S7-400 CPU 412-1 DP V7

Priority LOW 36CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416-2 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416F-2 DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 417-4 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions < V7.0.3), SIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.9), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-410 CPU family (incl. SIPLUS variants) (All versions < V8.2.1), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 V7 (All versions), SIPLUS S7-400 CPU 417-4 V7 (All versions). Specially crafted packets sent to port 102/tcp via Ethernet interface, via PROFIBUS, or via Multi Point Interfaces (MPI) could cause the affected devices to go into defect mode. Manual reboot is required to resume normal operation. Successful exploitation requires an attacker to be able to send specially crafted packets to port 102/tcp via Ethernet interface, via PROFIBUS or Multi Point Interfaces (MPI). No user interaction and no user privileges are required to exploit the security vulnerability. The vulnerability could allow causing a denial of service condition of the core functionality of the CPU, compromising the availability of the system.

Why it matters now

EPSS 0.01545 75th percentileScored 2026-11-07
Fix Fixed SIMATIC S7-400 CPU 414-3 PN/DP V7 (Siemens): V7.0.3SIMATIC S7-400 CPU 414F-3 PN/DP V7 (Siemens): V7.0.3+7 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC S7-400 CPU 412-1 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 412-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 414-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 414-3 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 414-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 414F-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 416-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 416-3 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 416-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 416F-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 416F-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 417-4 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 412-2 PN V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)before V6.0.9V6.0.9Patch availableCNA
SiemensSIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC S7-410 CPU family (incl. SIPLUS variants)before V8.2.1V8.2.1Patch availableCNA
SiemensSIPLUS S7-400 CPU 414-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIPLUS S7-400 CPU 416-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIPLUS S7-400 CPU 416-3 V7All versions—No fix listedCNA
SiemensSIPLUS S7-400 CPU 417-4 V7All versions—No fix listedCNA
  • SIMATIC S7-400 CPU 412-1 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 412-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 414-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 414-3 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 414-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 414F-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 416-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 416-3 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 416-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 416F-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 416F-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 417-4 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 412-2 PN V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) VendorSiemens Affected before V6.0.9 Fixed in V6.0.9 Patch available CNA
  • SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-410 CPU family (incl. SIPLUS variants) VendorSiemens Affected before V8.2.1 Fixed in V8.2.1 Patch available CNA
  • SIPLUS S7-400 CPU 414-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIPLUS S7-400 CPU 416-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIPLUS S7-400 CPU 416-3 V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIPLUS S7-400 CPU 417-4 V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_s7-400_firmware:*:*:*:*:*:*:*:*up to v6.0VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-400_pn\/dp_v7_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400_pn\/dp_v7:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-400h_firmware:*:*:*:*:*:*:*:*up to v4.5VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400h:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-410_firmware:*:*:*:*:*:*:*:*before 8.2.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-410:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-400h_v6_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400h_v6:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:simatic_s7-400_firmware:*:*:*:*:*:*:*:* Versions up to v6.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-400_pn\/dp_v7_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400_pn\/dp_v7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-400h_firmware:*:*:*:*:*:*:*:* Versions up to v4.5 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-410_firmware:*:*:*:*:*:*:*:* Versions before 8.2.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-400h_v6_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400h_v6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA SIMATIC S7-400 CPU 414-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 414F-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 416-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 416F-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 412-2 PN V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (Siemens) Fixed in V6.0.9
  • Fix · CNA SIMATIC S7-410 CPU family (incl. SIPLUS variants) (Siemens) Fixed in V8.2.1
  • Fix · CNA SIPLUS S7-400 CPU 414-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIPLUS S7-400 CPU 416-3 PN/DP V7 (Siemens) Fixed in V7.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16556
  2. 2026-10-03 Alias added: GHSA-h69h-mwxm-xg4v

References

Advisory 1

  • TI-2018-11877 Improper signature verification in Siemens SIMATIC S7-400 CPU 412-1 DP V7 CVSS 3.1HIGH 8.2
  • TI-2018-03427 Improper input validation in Siemens SIMATIC S7-400 CPU hardware version 4.0 and below… CVSS 3.0HIGH 7.5
  • TI-2017-01922 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
  • TI-2017-01923 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences