Simatic S7 200 Firmware CVE-2017-12741

Q: What is the CVSS score of CVE-2017-12741?

CVE-2017-12741 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 5.3%.

HIGH

Uncontrolled Resource Consumption (CWE-400)

2017-12-26 productcert@siemens.com

Denial Of Service Simatic S7 200 Firmware Simatic S7 400Pn V6 Firmware Simatic S7 400H V6 Firmware Simatic S7 400Pn Dp V7 Firmware Simatic S7 410 V8 Firmware Simatic S7 300 Firmware Simatic S7 1200 Firmware Simatic S7 1500 Firmware Simatic S7 1500 Controller Firmware Simatic Winac Rtx F 2010 Firmware Simatic Et 200Al Firmware Simatic Et 200Ecopn Firmware Simatic Et 200M Firmware Simatic Et 200Mp Firmware Simatic Et 200Pro Firmware Simatic Et 200S Firmware Simatic Et 200Sp Firmware Dk Standard Ethernet Controller Firmware Ek Ertec 200P Firmware Ek Ertec 200Pn Io Firmware Simotion D Firmware Simotion C Firmware Simotion P Firmware Sinamics Dcm Firmware Sinamics Dcp Firmware Sinamics G110M G120Pn Firmware Sinamics G130 Firmware Sinamics G150 Firmware Sinamics S110Pn Firmware Sinamics S120 Firmware Sinamics S150 V4 7 Firmware Sinamics S150 V4 8 Firmware Sinamics V90Pn Firmware Sinumerik 840D Sl Firmware Simatic Compact Field Unit Firmware Simatic Pn Pn Coupler Firmware Simocode Pro V Profinet Firmware Sirius Soft Starter 3Rw44Pn Firmware

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVE Published

Dec 26, 2017 - 04:29 cve.org

HIGH 8.7

DescriptionCVE.org

Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually.

AnalysisAI

Specially crafted packets sent to port 161/udp could cause a denial of service condition. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually. Affected products include: Siemens Simatic S7-200 Firmware, Siemens Simatic S7-400Pn V6 Firmware, Siemens Simatic S7-400H V6 Firmware, Siemens Simatic S7-400Pn\/Dp V7 Firmware, Siemens Simatic S7-410 V8 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.