Command injection in Siemens SIMATIC CP 1242-7 V2
Priority MEDIUM 47CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application does not correctly escape some user provided fields during the authentication process. This could allow an attacker to inject custom commands and execute arbitrary code with elevated privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02217 82nd percentileScored 2026-11-07
Fix Fixed SIMATIC CP 1242-7 V2 (Siemens): V3.3.46SIMATIC CP 1243-1 (Siemens): V3.3.46+8 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SIMATIC CP 1242-7 V2 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-1 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-7 LTE EU | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-7 LTE US | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1243-8 IRC | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIMATIC CP 1542SP-1 IRC | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIMATIC CP 1543-1 | before V3.0.22 | V3.0.22 | Patch available | CNA |
| Siemens | SIMATIC CP 1543SP-1 | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS ET 200SP CP 1543SP-1 ISEC | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL | All versions >= V2.0 < V2.2.28 | — | No fix listed | CNA |
| Siemens | SIPLUS NET CP 1242-7 V2 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIPLUS NET CP 1543-1 | before V3.0.22 | V3.0.22 | Patch available | CNA |
| Siemens | SIPLUS S7-1200 CP 1243-1 | before V3.3.46 | V3.3.46 | Patch available | CNA |
| Siemens | SIPLUS S7-1200 CP 1243-1 RAIL | before V3.3.46 | V3.3.46 | Patch available | CNA |
- SIMATIC CP 1242-7 V2 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-1 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-7 LTE EU VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-7 LTE US VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1243-8 IRC VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIMATIC CP 1542SP-1 IRC VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIMATIC CP 1543-1 VendorSiemens Affected before V3.0.22 Fixed in V3.0.22 Patch available CNA
- SIMATIC CP 1543SP-1 VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS ET 200SP CP 1543SP-1 ISEC VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL VendorSiemens Affected All versions >= V2.0 < V2.2.28 Fixed in — No fix listed CNA
- SIPLUS NET CP 1242-7 V2 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIPLUS NET CP 1543-1 VendorSiemens Affected before V3.0.22 Fixed in V3.0.22 Patch available CNA
- SIPLUS S7-1200 CP 1243-1 VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
- SIPLUS S7-1200 CP 1243-1 RAIL VendorSiemens Affected before V3.3.46 Fixed in V3.3.46 Patch available CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1242-7_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-1_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-7_lte_eu_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-7_lte_eu:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-7_lte_us_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-7_lte_us:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1243-8_irc_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1243-8_irc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1242-7_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-1_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-7_lte_eu_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte_eu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-7_lte_us_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-7_lte_us:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1243-8_irc_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1243-8_irc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:simatic_cp_1542sp-1_irc_firmware:*:*:*:*:*:*:*:* | 2.0 to before 2.2.28 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1542sp-1_irc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:* | before 3.0.22 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_cp_1543sp-1_firmware:*:*:*:*:*:*:*:* | 2.0 to before 2.2.28 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_cp_1543sp-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware:*:*:*:*:*:*:*:* | 2.0 to before 2.2.28 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_firmware:*:*:*:*:*:*:*:* | 2.0 to before 2.2.28 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware:*:*:*:*:*:*:*:* | 2.0 to before 2.2.28 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_net_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_net_cp_1242-7_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:* | before 3.0.22 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_rail_firmware:*:*:*:*:*:*:*:* | before 3.3.46 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1_rail:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:simatic_cp_1542sp-1_irc_firmware:*:*:*:*:*:*:*:* Versions 2.0 to before 2.2.28 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1542sp-1_irc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:* Versions before 3.0.22 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1543-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_cp_1543sp-1_firmware:*:*:*:*:*:*:*:* Versions 2.0 to before 2.2.28 Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_cp_1543sp-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware:*:*:*:*:*:*:*:* Versions 2.0 to before 2.2.28 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_et_200sp_cp_1542sp-1_irc_tx_rail:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_firmware:*:*:*:*:*:*:*:* Versions 2.0 to before 2.2.28 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware:*:*:*:*:*:*:*:* Versions 2.0 to before 2.2.28 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_et_200sp_cp_1543sp-1_isec_tx_rail:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_net_cp_1242-7_v2_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_net_cp_1242-7_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_net_cp_1543-1_firmware:*:*:*:*:*:*:*:* Versions before 3.0.22 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_net_cp_1543-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:siplus_s7-1200_cp_1243-1_rail_firmware:*:*:*:*:*:*:*:* Versions before 3.3.46 Vulnerable ·Siemens
- cpe:2.3:h:siemens:siplus_s7-1200_cp_1243-1_rail:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SIMATIC CP 1242-7 V2 (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-1 (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-7 LTE EU (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-7 LTE US (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1243-8 IRC (Siemens) Fixed in V3.3.46
- Fix · CNA SIMATIC CP 1543-1 (Siemens) Fixed in V3.0.22
- Fix · CNA SIPLUS NET CP 1242-7 V2 (Siemens) Fixed in V3.3.46
- Fix · CNA SIPLUS NET CP 1543-1 (Siemens) Fixed in V3.0.22
- Fix · CNA SIPLUS S7-1200 CP 1243-1 (Siemens) Fixed in V3.3.46
- Fix · CNA SIPLUS S7-1200 CP 1243-1 RAIL (Siemens) Fixed in V3.3.46
Timeline
- 2026-10-02 Threatist record created from CVE-2022-34820
- 2026-10-03 Alias added: GHSA-6j7x-87cm-p532
References
More Siemens Simatic Cp 1242-7 V2 Firmware vulnerabilities
- TI-2022-15626 Heap-based buffer overflow in Siemens SIMATIC CP 1242-7 V2 CVSS 3.1CRITICAL 10.0
- TI-2022-15628 Code injection in Siemens RUGGEDCOM RM1224 LTE EU CVSS 4.0HIGH 8.8
- TI-2022-21502 Resource allocation without limits in Siemens SIMATIC CP 1242-7 V2 CVSS 3.1HIGH 7.5
- TI-2022-21471 Use after free in Siemens SIMATIC CP 1242-7 V2 CVSS 3.1HIGH 7.5
- TI-2022-21501 A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All… CVSS 3.1HIGH 7.5
- TI-2023-19764 Memory leak in Siemens SIMATIC CP 1242-7 V2 CVSS 4.0HIGH 8.7
Sources
- CVE-2022-34820 · CVE Program
- CVE-2022-34820 · NVD
- FIRST EPSS
- GHSA-6j7x-87cm-p532 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences