Read the docs
TI-2023-27693 Aliases CVE-2023-50763GHSA-2r3h-3xfx-74q9

Infinite loop in Siemens SIMATIC CP 1542SP-1

Priority LOW 31CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-835.

Summary

A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). The web server of affected products, if configured to allow the import of PKCS12 containers, could end up in an infinite loop when processing incomplete certificate chains. This could allow an authenticated remote attacker to create a denial of service condition by importing specially crafted PKCS12 containers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00387 33rd percentileScored 2026-11-07
Fix Fixed SIMATIC CP 1542SP-1 (Siemens): V2.3SIMATIC CP 1542SP-1 IRC (Siemens): V2.3+6 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC CP 1542SP-1before V2.3V2.3Patch availableCNA
SiemensSIMATIC CP 1542SP-1 IRCbefore V2.3V2.3Patch availableCNA
SiemensSIMATIC CP 1543SP-1before V2.3V2.3Patch availableCNA
SiemensSIPLUS ET 200SP CP 1542SP-1 IRC TX RAILbefore V2.3V2.3Patch availableCNA
SiemensSIPLUS ET 200SP CP 1543SP-1 ISECbefore V2.3V2.3Patch availableCNA
SiemensSIPLUS ET 200SP CP 1543SP-1 ISEC TX RAILbefore V2.3V2.3Patch availableCNA
SiemensSIPLUS TIM 1531 IRCbefore V2.4.8V2.4.8Patch availableCNA
SiemensTIM 1531 IRCbefore V2.4.8V2.4.8Patch availableCNA
  • SIMATIC CP 1542SP-1 VendorSiemens Affected before V2.3 Fixed in V2.3 Patch available CNA
  • SIMATIC CP 1542SP-1 IRC VendorSiemens Affected before V2.3 Fixed in V2.3 Patch available CNA
  • SIMATIC CP 1543SP-1 VendorSiemens Affected before V2.3 Fixed in V2.3 Patch available CNA
  • SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL VendorSiemens Affected before V2.3 Fixed in V2.3 Patch available CNA
  • SIPLUS ET 200SP CP 1543SP-1 ISEC VendorSiemens Affected before V2.3 Fixed in V2.3 Patch available CNA
  • SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL VendorSiemens Affected before V2.3 Fixed in V2.3 Patch available CNA
  • SIPLUS TIM 1531 IRC VendorSiemens Affected before V2.4.8 Fixed in V2.4.8 Patch available CNA
  • TIM 1531 IRC VendorSiemens Affected before V2.4.8 Fixed in V2.4.8 Patch available CNA

Remediation

  • Fix · CNA SIMATIC CP 1542SP-1 (Siemens) Fixed in V2.3
  • Fix · CNA SIMATIC CP 1542SP-1 IRC (Siemens) Fixed in V2.3
  • Fix · CNA SIMATIC CP 1543SP-1 (Siemens) Fixed in V2.3
  • Fix · CNA SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (Siemens) Fixed in V2.3
  • Fix · CNA SIPLUS ET 200SP CP 1543SP-1 ISEC (Siemens) Fixed in V2.3
  • Fix · CNA SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (Siemens) Fixed in V2.3
  • Fix · CNA SIPLUS TIM 1531 IRC (Siemens) Fixed in V2.4.8
  • Fix · CNA TIM 1531 IRC (Siemens) Fixed in V2.4.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens SIPLUS TIM 1531 IRC, TIM 1531 IRC V2.4.8

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-19088 Incorrect numeric conversion in Siemens SIPLUS TIM 1531 IRCPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50763
  2. 2026-10-03 Alias added: GHSA-2r3h-3xfx-74q9

References

Other 3

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences