Read the docs
TI-2023-14569 Aliases CVE-2023-30755GHSA-44w9-25wr-fjwf

NULL pointer dereference in Siemens SIMATIC CP 1242-7 V2

Priority LOW 27CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-7 LTE (All versions < V3.5.20), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.5.20), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions), SIMATIC IPC DiagBase (All versions), SIMATIC IPC DiagMonitor (All versions), SIMATIC WinCC Runtime Advanced (All versions), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of the affected devices do not properly handle the shutdown or reboot request, which could lead to the clean up of certain resources. This could allow a remote attacker with elevated privileges to cause a denial of service condition in the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (Siemens): V3.5.20SIMATIC CP 1243-1 (incl. SIPLUS variants) (Siemens): V3.5.20+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)before V3.5.20V3.5.20Patch availableCNA
SiemensSIMATIC CP 1243-1 (incl. SIPLUS variants)before V3.5.20V3.5.20Patch availableCNA
SiemensSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)before V3.5.20V3.5.20Patch availableCNA
SiemensSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)before V3.5.20V3.5.20Patch availableCNA
SiemensSIMATIC CP 1243-7 LTEbefore V3.5.20V3.5.20Patch availableCNA
SiemensSIMATIC CP 1243-8 IRCbefore V3.5.20V3.5.20Patch availableCNA
SiemensSIMATIC HMI Comfort Panels (incl. SIPLUS variants)All versions—No fix listedCNA
SiemensSIMATIC IPC DiagBaseall versions—No fix listedCNA
SiemensSIMATIC IPC DiagMonitorAll versions—No fix listedCNA
SiemensSIMATIC WinCC Runtime AdvancedAll versions—No fix listedCNA
SiemensSIPLUS TIM 1531 IRCbefore V2.4.8V2.4.8Patch availableCNA
SiemensTIM 1531 IRCbefore V2.4.8V2.4.8Patch availableCNA
  • SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) VendorSiemens Affected before V3.5.20 Fixed in V3.5.20 Patch available CNA
  • SIMATIC CP 1243-1 (incl. SIPLUS variants) VendorSiemens Affected before V3.5.20 Fixed in V3.5.20 Patch available CNA
  • SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) VendorSiemens Affected before V3.5.20 Fixed in V3.5.20 Patch available CNA
  • SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) VendorSiemens Affected before V3.5.20 Fixed in V3.5.20 Patch available CNA
  • SIMATIC CP 1243-7 LTE VendorSiemens Affected before V3.5.20 Fixed in V3.5.20 Patch available CNA
  • SIMATIC CP 1243-8 IRC VendorSiemens Affected before V3.5.20 Fixed in V3.5.20 Patch available CNA
  • SIMATIC HMI Comfort Panels (incl. SIPLUS variants) VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC IPC DiagBase VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC IPC DiagMonitor VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIMATIC WinCC Runtime Advanced VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • SIPLUS TIM 1531 IRC VendorSiemens Affected before V2.4.8 Fixed in V2.4.8 Patch available CNA
  • TIM 1531 IRC VendorSiemens Affected before V2.4.8 Fixed in V2.4.8 Patch available CNA

Remediation

  • Fix · CNA SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (Siemens) Fixed in V3.5.20
  • Fix · CNA SIMATIC CP 1243-1 (incl. SIPLUS variants) (Siemens) Fixed in V3.5.20
  • Fix · CNA SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (Siemens) Fixed in V3.5.20
  • Fix · CNA SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (Siemens) Fixed in V3.5.20
  • Fix · CNA SIMATIC CP 1243-7 LTE (Siemens) Fixed in V3.5.20
  • Fix · CNA SIMATIC CP 1243-8 IRC (Siemens) Fixed in V3.5.20
  • Fix · CNA SIPLUS TIM 1531 IRC (Siemens) Fixed in V2.4.8
  • Fix · CNA TIM 1531 IRC (Siemens) Fixed in V2.4.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SIMATIC CP 1242-7 V2 (incl. SIPLUS variants), SIMATIC CP 1243-1 (incl. SIPLUS variants) and 6 more products V2.4.8, V3.5.20

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2023-14570 NULL pointer dereference in Siemens SIMATIC CP 1242-7 V2Priority LOW 36
    • TI-2023-13333 NULL pointer dereference in Siemens SIMATIC CP 1242-7 V2Priority LOW 36
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30755
  2. 2026-10-03 Alias added: GHSA-44w9-25wr-fjwf

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences