Read the docs
TI-2018-11877 Aliases CVE-2018-16557GHSA-5wjq-9mm7-ccm8

Improper signature verification in Siemens SIMATIC S7-400 CPU 412-1 DP V7

Priority LOW 37CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416-2 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416F-2 DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 417-4 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions < V7.0.3), SIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.9), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-410 CPU family (incl. SIPLUS variants) (All versions < V8.2.1), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 V7 (All versions), SIPLUS S7-400 CPU 417-4 V7 (All versions). Sending of specially crafted packets to port 102/tcp via Ethernet interface via PROFIBUS or Multi Point Interfaces (MPI) could cause a denial of service condition on affected devices. Flashing with a firmware image may be required to recover the CPU. Successful exploitation requires an attacker to have network access to port 102/tcp via Ethernet interface or to be able to send messages via PROFIBUS or Multi Point Interfaces (MPI) to the device. No user interaction is required. If no access protection is configured, no privileges are required to exploit the security vulnerability. The vulnerability could allow causing a denial of service condition of the core functionality of the CPU, compromising the availability of the system.

Why it matters now

EPSS 0.00821 57th percentileScored 2026-11-07
Fix Fixed SIMATIC S7-400 CPU 414-3 PN/DP V7 (Siemens): V7.0.3SIMATIC S7-400 CPU 414F-3 PN/DP V7 (Siemens): V7.0.3+7 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC S7-400 CPU 412-1 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 412-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 414-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 414-3 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 414-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 414F-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 416-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 416-3 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 416-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 416F-2 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 416F-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 CPU 417-4 DP V7All versions—No fix listedCNA
SiemensSIMATIC S7-400 CPU 412-2 PN V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)before V6.0.9V6.0.9Patch availableCNA
SiemensSIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC S7-410 CPU family (incl. SIPLUS variants)before V8.2.1V8.2.1Patch availableCNA
SiemensSIPLUS S7-400 CPU 414-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIPLUS S7-400 CPU 416-3 PN/DP V7before V7.0.3V7.0.3Patch availableCNA
SiemensSIPLUS S7-400 CPU 416-3 V7All versions—No fix listedCNA
SiemensSIPLUS S7-400 CPU 417-4 V7All versions—No fix listedCNA
  • SIMATIC S7-400 CPU 412-1 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 412-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 414-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 414-3 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 414-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 414F-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 416-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 416-3 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 416-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 416F-2 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 416F-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 CPU 417-4 DP V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 CPU 412-2 PN V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) VendorSiemens Affected before V6.0.9 Fixed in V6.0.9 Patch available CNA
  • SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC S7-410 CPU family (incl. SIPLUS variants) VendorSiemens Affected before V8.2.1 Fixed in V8.2.1 Patch available CNA
  • SIPLUS S7-400 CPU 414-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIPLUS S7-400 CPU 416-3 PN/DP V7 VendorSiemens Affected before V7.0.3 Fixed in V7.0.3 Patch available CNA
  • SIPLUS S7-400 CPU 416-3 V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIPLUS S7-400 CPU 417-4 V7 VendorSiemens Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_s7-400_firmware:*:*:*:*:*:*:*:*up to v6.0VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-400_pn\/dp_v7_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400_pn\/dp_v7:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-400h_firmware:*:*:*:*:*:*:*:*up to v4.5VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-400h:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-410_firmware:*:*:*:*:*:*:*:*before 8.2.1VulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-410:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-400h_firmware:*:*:*:*:*:*:*:*6.0.0 to before 6.0.9VulnerableSiemens
  • cpe:2.3:o:siemens:simatic_s7-400_firmware:*:*:*:*:*:*:*:* Versions up to v6.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-400_pn\/dp_v7_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400_pn\/dp_v7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-400h_firmware:*:*:*:*:*:*:*:* Versions up to v4.5 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-400h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-410_firmware:*:*:*:*:*:*:*:* Versions before 8.2.1 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-410:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-400h_firmware:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.9 Vulnerable ·Siemens

Remediation

  • Fix · CNA SIMATIC S7-400 CPU 414-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 414F-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 416-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 416F-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 CPU 412-2 PN V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (Siemens) Fixed in V6.0.9
  • Fix · CNA SIMATIC S7-410 CPU family (incl. SIPLUS variants) (Siemens) Fixed in V8.2.1
  • Fix · CNA SIPLUS S7-400 CPU 414-3 PN/DP V7 (Siemens) Fixed in V7.0.3
  • Fix · CNA SIPLUS S7-400 CPU 416-3 PN/DP V7 (Siemens) Fixed in V7.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16557
  2. 2026-10-03 Alias added: GHSA-5wjq-9mm7-ccm8

References

Advisory 1

  • TI-2018-03427 Improper input validation in Siemens SIMATIC S7-400 CPU hardware version 4.0 and below… CVSS 3.0HIGH 7.5
  • TI-2018-11876 Improper input validation in Siemens SIMATIC S7-400 CPU 412-1 DP V7 CVSS 3.1HIGH 7.5
  • TI-2017-01922 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
  • TI-2017-01923 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences