CVE-2021-37185

published 2022-02-09

CVE-2021-37185: A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 < V4.0 SP1), SIPLUS TIM…

Priority P3 45 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 = V21.9 = V4.5.0 = V2.9.2 = V21.9 = V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.

Affected

55 ranges · showing 25

Vendor	Product	Version range	Fixed in
siemens	simatic_drive_controller_cpu_1504d_tf_firmware	< 2.9.4	2.9.4
siemens	simatic_drive_controller_cpu_1507d_tf_firmware	< 2.9.4	2.9.4
siemens	simatic_drive_controller_family	—	—
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc2	—	—
siemens	simatic_s7-1200_cpu_1211c_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1212c_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1212fc_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1214c_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1214fc_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1215c_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1215fc_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_1217c_firmware	>= 4.5.0 < 4.5.2	4.5.2
siemens	simatic_s7-1200_cpu_family	—	—
siemens	simatic_s7-1500_cpu_1510sp-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1510sp_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1511-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1511c-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1511f-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1511t-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1511tf-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1512c-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1512sp-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1512spf-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1513-1_firmware	>= 2.9.2 < 2.9.4	2.9.4
siemens	simatic_s7-1500_cpu_1513f-1_firmware	>= 2.9.2 < 2.9.4	2.9.4

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 7.1 HIGH AV:N/AC:M/Au:N/C:N/I:N/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-672