CVE-2018-13815: siemens ag simatic s7-1200, simatic s7-1500 Insufficient Resource Pool

Vulnerability summary

CVE-2018-13815 is a high (CVSS 7.5) Insufficient Resource Pool vulnerability in siemens ag simatic s7-1200, simatic s7-1500. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities.

Timeline

1. 13-12-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacker could exhaust the available connection pool of an affected device by opening a sufficient number of connections to the device. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. The vulnerability, if exploited, could cause a Denial-of-Service condition impacting the availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known.

• CWE-410Insufficient Resource PoolThe product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.