Read the docs
TI-2025-27335 Aliases CVE-2025-40944GHSA-vqmm-3555-wq2q

Uncontrolled resource consumption in Siemens SIMATIC ET 200AL IM 157-1 PN

Priority MEDIUM 44CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (All versions), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (All versions < V1.3), SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) (All versions < V6.0.1), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (All versions >= V4.2.0 < V4.2.5), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (All versions < V4.2.2), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (All versions), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (All versions < V6.0.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (All versions < V6.0.0). Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, the devices enter an improper session state. This could allow an attacker to cause the device to become unresponsive, leading to a denial-of-service condition that requires a power cycle to restore normal operation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (Siemens): V1.3SIMATIC ET 200SP IM 155-6 PN R1 (Siemens): V6.0.1+7 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSIMATIC ET 200AL IM 157-1 PNall versions—No fix listedCNA
SiemensSIMATIC ET 200MP IM 155-5 PN HFV4.2.0 and later—No fix listedCNA
SiemensSIMATIC ET 200SP IM 155-6 MF HFall versions—No fix listedCNA
SiemensSIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)before V1.3V1.3Patch availableCNA
SiemensSIMATIC ET 200SP IM 155-6 PN R1before V6.0.1V6.0.1Patch availableCNA
SiemensSIMATIC ET 200SP IM 155-6 PN/2 HFV4.2.0 to before V4.2.5V4.2.5Patch availableCNA
SiemensSIMATIC ET 200SP IM 155-6 PN/3 HFbefore V4.2.2V4.2.2Patch availableCNA
SiemensSIMATIC PN/MF Couplerall versions—No fix listedCNA
SiemensSIMATIC PN/PN Couplerbefore V6.0.0V6.0.0Patch availableCNA
SiemensSIPLUS ET 200MP IM 155-5 PN HFV4.2.0 and later—No fix listedCNA
SiemensSIPLUS ET 200MP IM 155-5 PN HFV4.2.0 and later—No fix listedCNA
SiemensSIPLUS ET 200MP IM 155-5 PN HF T1 RAILV4.2.0 and later—No fix listedCNA
SiemensSIPLUS ET 200SP IM 155-6 PN HFV4.2.0 to before V4.2.5V4.2.5Patch availableCNA
SiemensSIPLUS ET 200SP IM 155-6 PN HFV4.2.0 to before V4.2.5V4.2.5Patch availableCNA
SiemensSIPLUS ET 200SP IM 155-6 PN HF T1 RAILV4.2.0 to before V4.2.5V4.2.5Patch availableCNA
SiemensSIPLUS ET 200SP IM 155-6 PN HF TX RAILV4.2.0 to before V4.2.5V4.2.5Patch availableCNA
SiemensSIPLUS NET PN/PN Couplerbefore V6.0.0V6.0.0Patch availableCNA
  • SIMATIC ET 200AL IM 157-1 PN VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC ET 200MP IM 155-5 PN HF VendorSiemens Affected V4.2.0 and later Fixed in — No fix listed CNA
  • SIMATIC ET 200SP IM 155-6 MF HF VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) VendorSiemens Affected before V1.3 Fixed in V1.3 Patch available CNA
  • SIMATIC ET 200SP IM 155-6 PN R1 VendorSiemens Affected before V6.0.1 Fixed in V6.0.1 Patch available CNA
  • SIMATIC ET 200SP IM 155-6 PN/2 HF VendorSiemens Affected V4.2.0 to before V4.2.5 Fixed in V4.2.5 Patch available CNA
  • SIMATIC ET 200SP IM 155-6 PN/3 HF VendorSiemens Affected before V4.2.2 Fixed in V4.2.2 Patch available CNA
  • SIMATIC PN/MF Coupler VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • SIMATIC PN/PN Coupler VendorSiemens Affected before V6.0.0 Fixed in V6.0.0 Patch available CNA
  • SIPLUS ET 200MP IM 155-5 PN HF VendorSiemens Affected V4.2.0 and later Fixed in — No fix listed CNA
  • SIPLUS ET 200MP IM 155-5 PN HF VendorSiemens Affected V4.2.0 and later Fixed in — No fix listed CNA
  • SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL VendorSiemens Affected V4.2.0 and later Fixed in — No fix listed CNA
  • SIPLUS ET 200SP IM 155-6 PN HF VendorSiemens Affected V4.2.0 to before V4.2.5 Fixed in V4.2.5 Patch available CNA
  • SIPLUS ET 200SP IM 155-6 PN HF VendorSiemens Affected V4.2.0 to before V4.2.5 Fixed in V4.2.5 Patch available CNA
  • SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL VendorSiemens Affected V4.2.0 to before V4.2.5 Fixed in V4.2.5 Patch available CNA
  • SIPLUS ET 200SP IM 155-6 PN HF TX RAIL VendorSiemens Affected V4.2.0 to before V4.2.5 Fixed in V4.2.5 Patch available CNA
  • SIPLUS NET PN/PN Coupler VendorSiemens Affected before V6.0.0 Fixed in V6.0.0 Patch available CNA

Remediation

  • Fix · CNA SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (Siemens) Fixed in V1.3
  • Fix · CNA SIMATIC ET 200SP IM 155-6 PN R1 (Siemens) Fixed in V6.0.1
  • Fix · CNA SIMATIC ET 200SP IM 155-6 PN/2 HF (Siemens) Fixed in V4.2.5
  • Fix · CNA SIMATIC ET 200SP IM 155-6 PN/3 HF (Siemens) Fixed in V4.2.2
  • Fix · CNA SIMATIC PN/PN Coupler (Siemens) Fixed in V6.0.0
  • Fix · CNA SIPLUS ET 200SP IM 155-6 PN HF (Siemens) Fixed in V4.2.5
  • Fix · CNA SIPLUS ET 200SP IM 155-6 PN HF (Siemens) Fixed in V4.2.5
  • Fix · CNA SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (Siemens) Fixed in V4.2.5
  • Fix · CNA SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (Siemens) Fixed in V4.2.5
  • Fix · CNA SIPLUS NET PN/PN Coupler (Siemens) Fixed in V6.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40944
  2. 2026-10-03 Alias added: GHSA-vqmm-3555-wq2q

References

Other 1

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences