Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller

CVE-2017-2681

HIGH 7.1

En bref

Source: NVD
EPSS: EPSS 0.91 % · centile 60 (2026-10-29)
État: PUBLISHED
Publiée: 2017-05-11 10:00 UTC
Mise à jour: 2024-09-10 09:33 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.

Faiblesses (CWE)

CWE-400 — Consommation de ressources non maîtrisée (déni de service)

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	siemens
CVSS 4.0	HIGH 7.1	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	siemens
CVSS 4.0	HIGH 7.1	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · productcert@siemens.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.1	AV:A/AC:L/Au:N/C:N/I:N/A:C	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2017-11824
GCVE · GCVE-0-2017-2681

Avis du CERT-FR

CERTFR-2022-AVI-124 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
CERTFR-2017-AVI-140 — Multiples vulnérabilités dans SCADA les produits Siemens · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:simatic_cp_343-1_std_firmware:*:*:*:*:*:*:*:* < 3.1.3
cpe:2.3:o:siemens:simatic_cp_343-1_lean_firmware:*:*:*:*:*:*:*:* < 3.1.3
cpe:2.3:o:siemens:simatic_cp_343-1_adv_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_cp_443-1_std_firmware:*:*:*:*:*:*:*:* < 3.2.17
cpe:2.3:o:siemens:simatic_cp_443-1_adv_firmware:*:*:*:*:*:*:*:* < 3.2.17
cpe:2.3:o:siemens:simatic_cp_443-1_opc-ua_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_cp_1243-1_firmware:*:*:*:*:*:*:*:* < 2.1.82
cpe:2.3:o:siemens:simatic_cm_1542-1_firmware:*:*:*:*:*:*:*:* < 2.0
cpe:2.3:o:siemens:simatic_cp_1543sp-1_firmware:*:*:*:*:*:*:*:* < 1.0.15
cpe:2.3:o:siemens:simatic_cp_1542sp-1_irc_firmware:*:*:*:*:*:*:*:* < 1.0.15
cpe:2.3:o:siemens:simatic_cp_1543sp-1_firmware:*:*:*:*:*:*:*:* < 2.1
cpe:2.3:o:siemens:simatic_cp_1543-1_firmware:*:*:*:*:*:*:*:* < 1.0.15
cpe:2.3:o:siemens:simatic_rf650r_firmware:*:*:*:*:*:*:*:* < 3.0
cpe:2.3:o:siemens:simatic_rf680r_firmware:*:*:*:*:*:*:*:* < 3.0
cpe:2.3:o:siemens:simatic_rf685r_firmware:*:*:*:*:*:*:*:* < 3.0
cpe:2.3:o:siemens:simatic_cp_1616_firmware:*:*:*:*:*:*:*:* < 2.7
cpe:2.3:o:siemens:simatic_cp_1604_firmware:*:*:*:*:*:*:*:* < 2.7
cpe:2.3:o:siemens:simatic_dk-16xx_pn_io_firmware:*:*:*:*:*:*:*:* < 2.7
cpe:2.3:o:siemens:scalance_x200_firmware:*:*:*:*:*:*:*:* < 5.2.2
cpe:2.3:o:siemens:scalance_x200_irt_firmware:*:*:*:*:*:*:*:* < 5.4.0
cpe:2.3:o:siemens:scalance_x300_firmware:*:*:*:*:*:*:*:* < 4.1.0
cpe:2.3:o:siemens:scalance_x408_firmware:*:*:*:*:*:*:*:* < 4.1.0
cpe:2.3:o:siemens:scalance_x414_firmware:*:*:*:*:*:*:*:* < 3.10.2
cpe:2.3:o:siemens:scalance_xm400_firmware:*:*:*:*:*:*:*:* < 6.1
cpe:2.3:o:siemens:scalance_xr500_firmware:*:*:*:*:*:*:*:* < 6.1
cpe:2.3:o:siemens:scalance_w700_firmware:*:*:*:*:*:*:*:* < 6.1
cpe:2.3:o:siemens:scalance_m-800_firmware:*:*:*:*:*:*:*:* < 4.03
cpe:2.3:o:siemens:scalance_s615_firmware:*:*:*:*:*:*:*:* < 4.03
cpe:2.3:o:siemens:softnet_profinet_io_firmware:*:*:*:*:*:*:*:* < 14
cpe:2.3:o:siemens:softnet_profinet_io_firmware:14:-:*:*:*:*:*:*
cpe:2.3:o:siemens:ie\/pb-link_firmware:*:*:*:*:*:*:*:* < 3.0
cpe:2.3:o:siemens:ie\/as-i_link_pn_io_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_teleservice_adapter_standard_modem_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_teleservice_adapter_ie_basic_modem_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_teleservice_adapter_ie_advanced_modem_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:sitop_psu8600_firmware:*:*:*:*:*:*:*:* < 1.2.0
cpe:2.3:o:siemens:ups1600_profinet_firmware:*:*:*:*:*:*:*:* < 2.2.0
cpe:2.3:o:siemens:simatic_et_200al_firmware:*:*:*:*:*:*:*:* < 1.0.2
cpe:2.3:o:siemens:simatic_et_200ecopn_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:simatic_et_200m_firmware:*:*:*:*:*:*:*:*
+60 autres

Produits affectés

Produit	Versions
Siemens · Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller	affected All versions < V4.1.1 Patch04
Siemens · Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200	affected All versions < V4.2.1 Patch03
Siemens · Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P	affected All versions < V4.4.0 Patch01
Siemens · IE/AS-i Link PN IO	affected All versions
Siemens · IE/PB-Link (incl. SIPLUS NET variants)	affected All versions < V3.0
Siemens · SCALANCE M-800 family (incl. S615, MUM-800 and RM1224)	affected All versions < V4.03
Siemens · SCALANCE W-700 IEEE 802.11n family	affected All versions < V6.1
Siemens · SCALANCE X-200 family (incl. SIPLUS NET variants)	affected All versions < V5.2.2
Siemens · SCALANCE X-200IRT family (incl. SIPLUS NET variants)	affected All versions < V5.4.0
Siemens · SCALANCE X-300 family (incl. X408 and SIPLUS NET variants)	affected All versions < V4.1.0
Siemens · SCALANCE X408 family	affected All versions < V4.1.0
Siemens · SCALANCE X414	affected All versions < V3.10.2
Siemens · SCALANCE XM-400 family	affected All versions < V6.1
Siemens · SCALANCE XR-500 family	affected All versions < V6.1
Siemens · SIMATIC CM 1542-1	affected All versions < V2.0
Siemens · SIMATIC CM 1542SP-1	affected All versions < V1.0.15
Siemens · SIMATIC CP 1243-1 (incl. SIPLUS variants)	affected All versions < V2.1.82
Siemens · SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)	affected 0 < *
Siemens · SIMATIC CP 1243-1 IEC (incl. SIPLUS variants)	affected All versions
Siemens · SIMATIC CP 1243-8 IRC	affected All versions < V2.1.82

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller