CVE-2021-37185: siemens simatic drive controller cpu 1504d tf

Vulnerability summary

CVE-2021-37185 is a high (CVSS 7.5) vulnerability in siemens simatic drive controller cpu 1504d tf. EPSS estimates a 2.06% chance of exploitation in the next 30 days, higher than 81% of scored vulnerabilities.

Timeline

1. 09-02-2022
   PublishedVulnerability first disclosed.
2. 18-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.

• CWE-672Operation on a Resource after Expiration or ReleaseThe product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.