CVE-2019-18336CWE-400

A vulnerability has been identified in SIMATIC S7-300 CPU family (incl

High · published March 10, 2020

CVSS v3.1
7.5
EPSS
2%
Percentile
77.2
In the wild
Unconfirmed
What it is

A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.X.17), SIMATIC TDC CP51M1 (All versions < V1.1.8), SIMATIC TDC CPU555 (All versions < V1.1.1), SINUMERIK 840D sl (All versions < V4.8.6), SINUMERIK 840D sl (All versions < V4.94). Specially crafted packets sent to port 102/tcp (Profinet) could cause the affected device to go into defect mode. A restart is required in order to recover the system. Successful exploitation requires an attacker to have network access to port 102/tcp, with no authentication. No user interation is required. At the time of advisory publication no public exploitation of this security vulnerability was known.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01716 · 77.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2020-03-10T19:16Z
EPSS history
Timeline
  • 10 MAR 19:16Z
    A vulnerability has been identified in SIMATIC S7-300 CPU family (incl
    cvelistv5