Read the docs
TI-2021-13111 Aliases CVE-2021-33737GHSA-w34c-jjqq-3824

Memory corruption in Siemens SIMATIC CP 343-1

Priority LOW 35CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 ERPC (All versions), SIMATIC CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 (All versions < V3.3), SIMATIC CP 443-1 Advanced (All versions < V3.3), SIPLUS NET CP 443-1 (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (All versions < V3.3). Sending a specially crafted packet to port 102/tcp of an affected device could cause a denial of service condition. A restart is needed to restore normal operations.

Why it matters now

EPSS 0.01056 64th percentileScored 2026-11-07
Fix Fixed SIMATIC CP 443-1 (Siemens): V3.3SIMATIC CP 443-1 Advanced (Siemens): V3.3+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC CP 343-1 (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC CP 343-1 Advanced (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC CP 343-1 ERPCAll versions—No fix listedCNA
SiemensSIMATIC CP 343-1 Lean (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC CP 443-1before V3.3V3.3Patch availableCNA
SiemensSIMATIC CP 443-1before V3.3V3.3Patch availableCNA
SiemensSIMATIC CP 443-1 Advancedbefore V3.3V3.3Patch availableCNA
SiemensSIPLUS NET CP 443-1before V3.3V3.3Patch availableCNA
SiemensSIPLUS NET CP 443-1 Advancedbefore V3.3V3.3Patch availableCNA
  • SIMATIC CP 343-1 (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC CP 343-1 ERPC VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC CP 343-1 Lean (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC CP 443-1 VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA
  • SIMATIC CP 443-1 VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA
  • SIMATIC CP 443-1 Advanced VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA
  • SIPLUS NET CP 443-1 VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA
  • SIPLUS NET CP 443-1 Advanced VendorSiemens Affected before V3.3 Fixed in V3.3 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_cp_343-1_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_cp343-1:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_cp_343-1_advanced_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_cp343-1_advanced:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:simatic_cp_343-1_erpc_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_cp_343-1_erpc:*:*:*:*:*:*:*:*all versionsRunning onSiemens
cpe:2.3:o:siemens:simatic_cp_343-1_lean_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_cp_343-1_lean:*:*:*:*:*:*:*:*all versionsRunning onSiemens
cpe:2.3:o:siemens:simatic_cp_443-1_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_cp_443-1:*:*:*:*:*:*:*:*all versionsRunning onSiemens
  • cpe:2.3:o:siemens:simatic_cp_343-1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_cp343-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_cp_343-1_advanced_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_cp343-1_advanced:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_cp_343-1_erpc_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_cp_343-1_erpc:*:*:*:*:*:*:*:* Versions all versions Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_cp_343-1_lean_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_cp_343-1_lean:*:*:*:*:*:*:*:* Versions all versions Running on ·Siemens
  • cpe:2.3:o:siemens:simatic_cp_443-1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_cp_443-1:*:*:*:*:*:*:*:* Versions all versions Running on ·Siemens
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:siemens:simatic_cp_443-1_advanced_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:simatic_cp_443-1_advanced:*:*:*:*:*:*:*:*all versionsRunning onSiemens
  • cpe:2.3:o:siemens:simatic_cp_443-1_advanced_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:simatic_cp_443-1_advanced:*:*:*:*:*:*:*:* Versions all versions Running on ·Siemens

Remediation

  • Fix · CNA SIMATIC CP 443-1 (Siemens) Fixed in V3.3
  • Fix · CNA SIMATIC CP 443-1 (Siemens) Fixed in V3.3
  • Fix · CNA SIMATIC CP 443-1 Advanced (Siemens) Fixed in V3.3
  • Fix · CNA SIPLUS NET CP 443-1 (Siemens) Fixed in V3.3
  • Fix · CNA SIPLUS NET CP 443-1 Advanced (Siemens) Fixed in V3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33737
  2. 2026-10-03 Alias added: GHSA-w34c-jjqq-3824

References

Patch 1

  • TI-2019-10399 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences