Uncontrolled resource consumption in Siemens SIMATIC S7-300 CPU family
Priority MEDIUM 42CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.
Summary
A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (All versions < V1.1.8), SIMATIC TDC CPU555 (All versions < V1.1.1), SINUMERIK 840D sl (All versions < V4.8.6), SINUMERIK 840D sl (All versions < V4.94). Specially crafted packets sent to port 102/tcp (Profinet) could cause the affected device to go into defect mode. A restart is required in order to recover the system. Successful exploitation requires an attacker to have network access to port 102/tcp, with no authentication. No user interation is required. At the time of advisory publication no public exploitation of this security vulnerability was known.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01716 77th percentileScored 2026-11-07
Fix Fixed SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (Siemens AG): V3.X.17SIMATIC TDC CP51M1 (Siemens AG): V1.1.8+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) | before V3.X.17 | V3.X.17 | Patch available | CNA |
| Siemens | SIMATIC TDC CP51M1 | before V1.1.8 | V1.1.8 | Patch available | CNA |
| Siemens | SIMATIC TDC CPU555 | before V1.1.1 | V1.1.1 | Patch available | CNA |
| Siemens | SINUMERIK 840D sl | before V4.8.6 | V4.8.6 | Patch available | CNA |
| Siemens | SINUMERIK 840D sl | before V4.94 | V4.94 | Patch available | CNA |
- SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) VendorSiemens Affected before V3.X.17 Fixed in V3.X.17 Patch available CNA
- SIMATIC TDC CP51M1 VendorSiemens Affected before V1.1.8 Fixed in V1.1.8 Patch available CNA
- SIMATIC TDC CPU555 VendorSiemens Affected before V1.1.1 Fixed in V1.1.1 Patch available CNA
- SINUMERIK 840D sl VendorSiemens Affected before V4.8.6 Fixed in V4.8.6 Patch available CNA
- SINUMERIK 840D sl VendorSiemens Affected before V4.94 Fixed in V4.94 Patch available CNA
CPE configurations NVD · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_s7-300_cpu_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_312_ifm_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_312_ifm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_313_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_313:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_314_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_314:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_314_ifm_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_314_ifm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_s7-300_cpu_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_312_ifm_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_312_ifm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_313_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_313:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_314_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_314:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_314_ifm_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_314_ifm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_s7-300_cpu_315_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_315:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_315-2_dp_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_315-2_dp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_316-2_dp_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_316-2_dp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_s7-300_cpu_318-2_firmware:*:*:*:*:*:*:*:* | before 3.3.17 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_s7-300_cpu_318-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:a:siemens:sinumerik_840d_sl:*:*:*:*:*:*:*:* | before 4.8.6; before 4.94 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:simatic_tdc_cp51m1_firmware:*:*:*:*:*:*:*:* | before 1.1.8 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_tdc_cp51m1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_tdc_cpu555_firmware:*:*:*:*:*:*:*:* | before 1.1.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_tdc_cpu555:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_s7-300_cpu_315_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_315:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_315-2_dp_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_315-2_dp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_316-2_dp_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_316-2_dp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_s7-300_cpu_318-2_firmware:*:*:*:*:*:*:*:* Versions before 3.3.17 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_s7-300_cpu_318-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:a:siemens:sinumerik_840d_sl:*:*:*:*:*:*:*:* Versions before 4.8.6; before 4.94 Vulnerable ·Siemens
- cpe:2.3:o:siemens:simatic_tdc_cp51m1_firmware:*:*:*:*:*:*:*:* Versions before 1.1.8 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_tdc_cp51m1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_tdc_cpu555_firmware:*:*:*:*:*:*:*:* Versions before 1.1.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_tdc_cpu555:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (Siemens AG) Fixed in V3.X.17
- Fix · CNA SIMATIC TDC CP51M1 (Siemens AG) Fixed in V1.1.8
- Fix · CNA SIMATIC TDC CPU555 (Siemens AG) Fixed in V1.1.1
- Fix · CNA SINUMERIK 840D sl (Siemens AG) Fixed in V4.8.6
- Fix · CNA SINUMERIK 840D sl (Siemens AG) Fixed in V4.94
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18336
- 2026-10-03 Alias added: GHSA-q53p-vg4g-3rxp
References
More Siemens Simatic S7-300 Cpu 312 Ifm Firmware vulnerabilities
- TI-2019-08156 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 3.1HIGH 7.5
- TI-2019-08144 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-18336 · CVE Program
- CVE-2019-18336 · NVD
- FIRST EPSS
- GHSA-q53p-vg4g-3rxp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences