Read the docs
TI-2018-11880 Aliases CVE-2018-16561GHSA-w9hm-m2x5-5x42

Improper input validation in Siemens SIMATIC S7-300 CPUs

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication packets which could cause a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart. Successful exploitation requires an attacker to be able to send a specially crafted S7 communication packet to a communication interface of the CPU. This includes Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the core functionality of the CPU, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01396 72nd percentileScored 2026-11-07
Fix Fixed SIMATIC S7-300 CPUs (Siemens): V3.X.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC S7-300 CPUsbefore V3.X.16V3.X.16Patch availableCNA
  • SIMATIC S7-300 CPUs VendorSiemens Affected before V3.X.16 Fixed in V3.X.16 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_s7-300_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-300:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-300f_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-300f:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-300fs_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-300fs:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_s7-300t_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
cpe:2.3:h:siemens:simatic_s7-300t:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:simatic_s7-300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-300f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-300f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-300fs_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-300fs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_s7-300t_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_s7-300t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA SIMATIC S7-300 CPUs (Siemens) Fixed in V3.X.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16561
  2. 2026-10-03 Alias added: GHSA-w9hm-m2x5-5x42

References

Advisory 1

  • TI-2017-09446 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 8.7
  • TI-2019-04622 Out-of-bounds read in Siemens SIMATIC CP 1604 CVSS 3.1HIGH 7.5
  • TI-2017-01922 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
  • TI-2017-01923 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
  • TI-2018-03420 Improper input validation in Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7 CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences