Heap-based buffer overflow in Siemens SIMATIC CP 1242-7 V2
Priority MEDIUM 53CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application lacks proper validation of user-supplied data when parsing specific messages. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02083 81st percentileScored 2026-11-07
Fix Fixed SIMATIC CP 1242-7 V2 (Siemens): V3.3.46SIMATIC CP 1243-1 (Siemens): V3.3.46+8 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC CP 1242-7 V2 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-1 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-7 LTE EU | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-7 LTE US | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-8 IRC | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1542SP-1 IRC | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIMATIC CP 1543-1 | before V3.0.22 | V3.0.22 | Patch available | CNA |
| Siemens | SIMATIC CP 1543SP-1 | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS ET 200SP CP 1543SP-1 ISEC | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS NET CP 1242-7 V2 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIPLUS NET CP 1543-1 | before V3.0.22 | V3.0.22 | Patch available | CNA |
| Siemens | SIPLUS S7-1200 CP 1243-1 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIPLUS S7-1200 CP 1243-1 RAIL | before V3.3.46 | V3.3.46 | Patch available | CNA |
- SIMATIC CP 1242-7 V2 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-1 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-7 LTE EU VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-7 LTE US VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-8 IRC VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1542SP-1 IRC VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIMATIC CP 1543-1 VendorSiemens Affected before V3.0.22 Fixed in V3.0.22 Patch available CNA
- SIMATIC CP 1543SP-1 VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS ET 200SP CP 1543SP-1 ISEC VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS NET CP 1242-7 V2 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIPLUS NET CP 1543-1 VendorSiemens Affected before V3.0.22 Fixed in V3.0.22 Patch available CNA
- SIPLUS S7-1200 CP 1243-1 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIPLUS S7-1200 CP 1243-1 RAIL VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1242-7_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-1_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-7_lte_eu_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-7_lte_eu:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-7_lte_us_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-7_lte_us:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-8_irc_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-8_irc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1242-7_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-7_lte_eu_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte_eu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-7_lte_us_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte_us:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-8_irc_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-8_irc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_cp_1542sp-1_irc_firmware:*:*:*:*:*:*:*:* | 2.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1542sp-1_irc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:* | before 3.0.22 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1543sp-1_firmware:*:*:*:*:*:*:*:* | 2.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1543sp-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware:*:*:*:*:*:*:*:* | 2.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_firmware:*:*:*:*:*:*:*:* | 2.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware:*:*:*:*:*:*:*:* | 2.0 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_net_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_net_cp_1242-7_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:* | before 3.0.22 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_rail_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1_rail:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_cp_1542sp-1_irc_firmware:*:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1542sp-1_irc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:* Versions before 3.0.22 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1543sp-1_firmware:*:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1543sp-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware:*:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_firmware:*:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware:*:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_net_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_net_cp_1242-7_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:* Versions before 3.0.22 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_rail_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1_rail:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SIMATIC CP 1242-7 V2 (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-1 (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-7 LTE EU (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-7 LTE US (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-8 IRC (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1543-1 (Siemens) Fixed in V3.0.22
- Fix · CNA SIPLUS NET CP 1242-7 V2 (Siemens) Fixed in V3.3.46
- Fix · CNA SIPLUS NET CP 1543-1 (Siemens) Fixed in V3.0.22
- Fix · CNA SIPLUS S7-1200 CP 1243-1 (Siemens) Fixed in V3.3.46
- Fix · CNA SIPLUS S7-1200 CP 1243-1 RAIL (Siemens) Fixed in V3.3.46
Timeline
- 2026-10-02 Threatist record created from CVE-2022-34819
- 2026-10-03 Alias added: GHSA-x7cp-9x6c-2mm8
References
More Siemens Simatic Cp 1242-7 V2 Firmware vulnerabilities
- TI-2022-15627 Command injection in Siemens SIMATIC CP 1242-7 V2 CVSS 3.1CRITICAL 9.8
- TI-2022-15628 Code injection in Siemens RUGGEDCOM RM1224 LTE EU CVSS 4.0HIGH 8.8
- TI-2022-21502 Resource allocation without limits in Siemens SIMATIC CP 1242-7 V2 CVSS 3.1HIGH 7.5
- TI-2022-21471 Use after free in Siemens SIMATIC CP 1242-7 V2 CVSS 3.1HIGH 7.5
- TI-2022-21501 A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All… CVSS 3.1HIGH 7.5
- TI-2023-19764 Memory leak in Siemens SIMATIC CP 1242-7 V2 CVSS 4.0HIGH 8.7
Sources
- CVE-2022-34819 · CVE Program
- CVE-2022-34819 · NVD
- FIRST EPSS
- GHSA-x7cp-9x6c-2mm8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences