Vulnerability Description
A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414-2 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 DP V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416-2 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 416F-2 DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 417-4 DP V7 (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.10), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) (All versions < V10.1), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions < V8.2.3), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 V7 (All versions), SIPLUS S7-400 CPU 417-4 V7 (All versions). Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to create a Denial-of-Service condition. A restart is needed to restore normal operations.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Simatic S7-400H V6 Firmware | < 6.0.10 |
| Siemens | Simatic S7-400H V6 | - |
| Siemens | Simatic S7-400 Pn\/Dp V7 Firmware | All versions |
| Siemens | Simatic S7-400 Pn\/Dp V7 | - |
| Siemens | Simatic S7-410 V8 Firmware | All versions |
| Siemens | Simatic S7-410 V8 | - |
| Siemens | Simatic S7-410 V10 Firmware | < 10.1 |
| Siemens | Simatic S7-410 V10 | - |
Related Weaknesses (CWE)
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-557541.pdfPatchVendor Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-557541.pdfPatchVendor Advisory
FAQ
What is CVE-2021-40368?
CVE-2021-40368 is a vulnerability with a CVSS score of 7.5 (HIGH). A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 PN/DP V7 (All versions < V7.0.3), SIMA...
How severe is CVE-2021-40368?
CVE-2021-40368 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-40368?
Check the references section above for vendor advisories and patch information. Affected products include: Siemens Simatic S7-400H V6 Firmware, Siemens Simatic S7-400H V6, Siemens Simatic S7-400 Pn\/Dp V7 Firmware, Siemens Simatic S7-400 Pn\/Dp V7, Siemens Simatic S7-410 V8 Firmware.