www.cisa.gov Open in urlscan Pro
2a02:26f0:4700:18b::447a  Public Scan

Form analysis
2 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

Skip to main content

An official website of the United States government

Here’s how you know

Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.

Free Cyber Services#protect2024Secure Our WorldShields UpReport A Cyber Issue



Search

×

search
 

Menu



Close
×

search
 

 * Topics
   Topics
   Cybersecurity Best Practices
   Cyber Threats and Advisories
   Critical Infrastructure Security and Resilience
   Election Security
   Emergency Communications
   Industrial Control Systems
   Information and Communications Technology Supply Chain Security
   Partnerships and Collaboration
   Physical Security
   Risk Management
   How can we help?
   GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
   TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
   LocallyFaith-Based CommunityExecutivesHigh-Risk Communities
 * Spotlight
 * Resources & Tools
   Resources & Tools
   All Resources & Tools
   Services
   Programs
   Resources
   Training
   Groups
 * News & Events
   News & Events
   News
   Events
   Cybersecurity Alerts & Advisories
   Directives
   Request a CISA Speaker
   Congressional Testimony
   CISA Conferences
   CISA Live!
 * Careers
   Careers
   Benefits & Perks
   HireVue Applicant Reasonable Accommodations Process
   Hiring
   Resume & Application Tips
   Students & Recent Graduates
   Veteran and Military Spouses
   Work @ CISA
 * About
   About
   Culture
   Divisions & Offices
   Regions
   Leadership
   Doing Business with CISA
   Site Links
   Reporting Employee and Contractor Misconduct
   CISA GitHub
   CISA Central
   2023 Year In Review
   Contact Us
   Subscribe

Free Cyber Services#protect2024Secure Our WorldShields UpReport A Cyber Issue

Breadcrumb
 1. Home
 2. News & Events
 3. Cybersecurity Advisories
 4. ICS Advisory

Share:


ICS Advisory


SIEMENS SIMATIC S7-200 SMART DEVICES

Release Date
September 17, 2024
Alert Code
ICSA-24-261-01
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems


As of January 10, 2023, CISA will no longer be updating ICS security advisories
for Siemens product vulnerabilities beyond the initial advisory. For the most
up-to-date information on vulnerabilities in this advisory, please see Siemens'
ProductCERT Security Advisories (CERT Services | Services | Siemens
Global).(link is external) 

View CSAF(link is external)


1. EXECUTIVE SUMMARY

 * CVSS v4 8.7
 * ATTENTION: Exploitable remotely/low attack complexity
 * Vendor: Siemens
 * Equipment: SIMATIC S7-200 SMART Devices
 * Vulnerability: Uncontrolled Resource Consumption


2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to cause a
denial-of-service condition.


3. TECHNICAL DETAILS


3.1 AFFECTED PRODUCTS

The following versions of Siemens SIMATIC S7-200 SMART Devices are affected:

 * SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0): All versions
 * SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU SR20 (6ES7288-1SR20-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU SR30 (6ES7288-1SR30-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU SR40 (6ES7288-1SR40-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU SR60 (6ES7288-1SR60-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU ST20 (6ES7288-1ST20-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU ST30 (6ES7288-1ST30-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU ST40 (6ES7288-1ST40-0AA1): All Versions
 * SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA0): All Versions
 * SIMATIC S7-200 SMART CPU ST60 (6ES7288-1ST60-0AA1): All Versions


3.2 VULNERABILITY OVERVIEW

3.2.1 UNCONTROLLED RESOURCE CONSUMPTION CWE-400(LINK IS EXTERNAL)

Affected devices do not properly handle TCP packets with an incorrect structure.
This could allow an unauthenticated remote attacker to cause a denial of service
condition. To restore normal operations, the network cable of the device needs
to be unplugged and re-plugged.

CVE-2024-43647(link is external) has been assigned to this vulnerability. A CVSS
v3.1 base score of 7.5 has been calculated; the CVSS vector string is
(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H(link is external)).

A CVSS v4 score has also been calculated for CVE-2024-43647(link is external). A
base score of 8.7 has been calculated; the CVSS vector string is
(CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N(link is
external)).


3.3 BACKGROUND

 * CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
 * COUNTRIES/AREAS DEPLOYED: Worldwide
 * COMPANY HEADQUARTERS LOCATION: Germany


3.4 RESEARCHER

Siemens reported this vulnerability to CISA.


4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations that
users can apply to reduce the risk:

 * Limit network access to trusted users and systems only

Please use the following General Security Recommendations:

As a general security measure, Siemens strongly recommends users protect network
access to devices with appropriate mechanisms. In order to operate the devices
in a protected IT environment, Siemens recommends users configure the
environment according to Siemens' operational guidelines for Industrial
Security(link is external), and to follow the recommendations in the product
manuals. Additional information on Industrial Security by Siemens can be found
here(link is external).

For further inquiries on security vulnerabilities in Siemens products and
solutions, please view contact the Siemens ProductCERT(link is external)

For more information see the associated Siemens security advisory SSA-969738 in
HTML(link is external) and CSAF(link is external).

CISA recommends users take defensive measures to minimize the risk of
exploitation of this vulnerability, such as:

 * Minimize network exposure for all control system devices and/or systems,
   ensuring they are not accessible from the internet.
 * Locate control system networks and remote devices behind firewalls and
   isolating them from business networks.
 * When remote access is required, use more secure methods, such as Virtual
   Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should
   be updated to the most current version available. Also recognize VPN is only
   as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.

Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.

CISA also recommends users take the following measures to protect themselves
from social engineering attacks:

 * Do not click web links or open attachments in unsolicited email messages.
 * Refer to Recognizing and Avoiding Email Scams for more information on
   avoiding email scams.
 * Refer to Avoiding Social Engineering and Phishing Attacks for more
   information on social engineering attacks.

No known public exploitation specifically targeting this vulnerability has been
reported to CISA at this time.


5. UPDATE HISTORY

 * September 17, 2024: Initial Publication

This product is provided subject to this Notification and this Privacy &
Use policy.


VENDOR

 * Siemens


TAGS

Topics
Industrial Control System Vulnerabilities, Industrial Control Systems
Sector
Critical Manufacturing Sector


PLEASE SHARE YOUR THOUGHTS

We recently updated our anonymous product survey; we’d welcome your feedback.


RELATED ADVISORIES

Sep 17, 2024
ICS Advisory | ICSA-24-261-02


MILLBECK COMMUNICATIONS PROROUTE H685T-W

Sep 17, 2024
ICS Advisory | ICSA-24-261-03


YOKOGAWA DUAL-REDUNDANT PLATFORM FOR COMPUTER (PC2CKM)

Sep 12, 2024
ICS Advisory | ICSA-24-256-22


ROCKWELL AUTOMATION FACTORYTALK BATCH VIEW

Sep 12, 2024
ICS Advisory | ICSA-24-256-25


ROCKWELL AUTOMATION THINMANAGER

Return to top
 * Topics
 * Spotlight
 * Resources & Tools
 * News & Events
 * Careers
 * About

Cybersecurity & Infrastructure Security Agency
 * Facebook
 * Twitter
 * LinkedIn
 * YouTube
 * Instagram
 * RSS

CISA Central 1-844-Say-CISA SayCISA@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
 * About CISA
 * Budget and Performance
 * DHS.gov
 * Equal Opportunity & Accessibility
 * FOIA Requests
 * No FEAR Act
 * Office of Inspector General
 * Privacy Policy
 * Subscribe
 * The White House
 * USA.gov
 * Website Feedback