{"schemaVersion":3,"id":"CVE-2022-43716","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE0) (All versions < V3.3), SIMATIC CP 443-1 (6GK7443-1EX30-0XE1) (All versions < V3.3), SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0) (All versions < V3.3), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) (All versions < V3.4.29), SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0) (All versions < V3.3), SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0) (All versions < V3.3), SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) (All versions < V3.4.29), SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) (All versions < V3.4.29), SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.3.6), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.3.6). The webserver of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation which leads to a restart of the webserver of the affected product.","dates":{"published":"2023-04-11T09:02:49.383Z","modified":"2024-09-10T09:33:31.854Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00954,"percentile":0.60674,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.00954},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00954,"percentile":0.60674}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00954,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00954,"percentile":0.60674}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-416","name":"Use After Free","description":"The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory \"belongs\" to the code that operates on the new pointer.","type":"weakness","status":"Stable","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/416.html"}],"affected":[{"vendor":"siemens","product":"simatic_cp_1242-7_v2_firmware","name":"simatic cp 1242-7 v2 firmware","label":"simatic_cp_1242-7_v2_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1242-7_v2"},{"vendor":"siemens","product":"simatic_cp_1243-1_firmware","name":"simatic cp 1243-1 firmware","label":"simatic_cp_1243-1_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1243-1"},{"vendor":"siemens","product":"simatic cp 1243-1 dnp3 (incl. siplus variants)","name":"SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)","label":"simatic cp 1243-1 dnp3 (incl. siplus variants)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1243-1_dnp3_incl_siplus_variants"},{"vendor":"siemens","product":"simatic cp 1243-1 iec (incl. siplus variants)","name":"SIMATIC CP 1243-1 IEC (incl. SIPLUS variants)","label":"simatic cp 1243-1 iec (incl. siplus variants)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1243-1_iec_incl_siplus_variants"},{"vendor":"siemens","product":"simatic_cp_1243-7_lte_eu_firmware","name":"simatic cp 1243-7 lte eu firmware","label":"simatic_cp_1243-7_lte_eu_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1243-7_lte_eu"},{"vendor":"siemens","product":"simatic_cp_1243-7_lte_us_firmware","name":"simatic cp 1243-7 lte us firmware","label":"simatic_cp_1243-7_lte_us_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1243-7_lte_us"},{"vendor":"siemens","product":"simatic_cp_1243-8_irc_firmware","name":"simatic cp 1243-8 irc firmware","label":"simatic_cp_1243-8_irc_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1243-8_irc"},{"vendor":"siemens","product":"simatic_cp_1542sp-1_firmware","name":"simatic cp 1542sp-1 firmware","label":"simatic_cp_1542sp-1_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1542sp-1"},{"vendor":"siemens","product":"simatic_cp_1542sp-1_irc_firmware","name":"simatic cp 1542sp-1 irc firmware","label":"simatic_cp_1542sp-1_irc_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1542sp-1_irc"},{"vendor":"siemens","product":"simatic_cp_1543sp-1_firmware","name":"simatic cp 1543sp-1 firmware","label":"simatic_cp_1543sp-1_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3","eol":null,"hubHref":"/vendor/siemens/simatic_cp_1543sp-1"},{"vendor":"siemens","product":"simatic_cp_443-1_firmware","name":"simatic cp 443-1 firmware","label":"simatic_cp_443-1_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.3 | < 3.3","eol":null,"hubHref":"/vendor/siemens/simatic_cp_443-1"},{"vendor":"siemens","product":"simatic_cp_443-1_advanced_firmware","name":"simatic cp 443-1 advanced firmware","label":"simatic_cp_443-1_advanced_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.3 | < 3.3","eol":null,"hubHref":"/vendor/siemens/simatic_cp_443-1_advanced"},{"vendor":"siemens","product":"siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware","name":"siplus et 200sp cp 1542sp-1 irc tx rail firmware","label":"siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3","eol":null,"hubHref":"/vendor/siemens/siplus_et_200sp_cp_1542sp-1_irc_tx_rail"},{"vendor":"siemens","product":"siplus_et_200sp_cp_1543sp-1_isec_firmware","name":"siplus et 200sp cp 1543sp-1 isec firmware","label":"siplus_et_200sp_cp_1543sp-1_isec_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3","eol":null,"hubHref":"/vendor/siemens/siplus_et_200sp_cp_1543sp-1_isec"},{"vendor":"siemens","product":"siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware","name":"siplus et 200sp cp 1543sp-1 isec tx rail firmware","label":"siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3","eol":null,"hubHref":"/vendor/siemens/siplus_et_200sp_cp_1543sp-1_isec_tx_rail"},{"vendor":"siemens","product":"siplus_net_cp_1242-7_v2_firmware","name":"siplus net cp 1242-7 v2 firmware","label":"siplus_net_cp_1242-7_v2_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/siplus_net_cp_1242-7_v2"},{"vendor":"siemens","product":"siplus_net_cp_443-1_firmware","name":"siplus net cp 443-1 firmware","label":"siplus_net_cp_443-1_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.3 | < 3.3","eol":null,"hubHref":"/vendor/siemens/siplus_net_cp_443-1"},{"vendor":"siemens","product":"siplus_net_cp_443-1_advanced_firmware","name":"siplus net cp 443-1 advanced firmware","label":"siplus_net_cp_443-1_advanced_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.3 | < 3.3","eol":null,"hubHref":"/vendor/siemens/siplus_net_cp_443-1_advanced"},{"vendor":"siemens","product":"siplus_s7-1200_cp_1243-1_firmware","name":"siplus s7-1200 cp 1243-1 firmware","label":"siplus_s7-1200_cp_1243-1_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/siplus_s7-1200_cp_1243-1"},{"vendor":"siemens","product":"siplus_s7-1200_cp_1243-1_rail_firmware","name":"siplus s7-1200 cp 1243-1 rail firmware","label":"siplus_s7-1200_cp_1243-1_rail_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V3.4.29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.4.29","eol":null,"hubHref":"/vendor/siemens/siplus_s7-1200_cp_1243-1_rail"},{"vendor":"siemens","product":"siplus_tim_1531_irc_firmware","name":"siplus tim 1531 irc firmware","label":"siplus_tim_1531_irc_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3.6","noFixRecorded":false,"fixedIn":null},{"text":"< 2.3.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3.6 | < 2.3.6","eol":null,"hubHref":"/vendor/siemens/siplus_tim_1531_irc"},{"vendor":"siemens","product":"tim_1531_irc_firmware","name":"tim 1531 irc firmware","label":"tim_1531_irc_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< V2.3.6","noFixRecorded":false,"fixedIn":null},{"text":"< 2.3.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V2.3.6 | < 2.3.6","eol":null,"hubHref":"/vendor/siemens/tim_1531_irc"}],"affectedCount":22,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-566905.pdf","label":"cert-portal.siemens.com/productcert/pdf/ssa-566905.pdf","hostname":"cert-portal.siemens.com","tags":["Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-139628.html","label":"cert-portal.siemens.com/productcert/html/ssa-139628.html","hostname":"cert-portal.siemens.com","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-566905.html","label":"cert-portal.siemens.com/productcert/html/ssa-566905.html","hostname":"cert-portal.siemens.com","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-04-11T09:02:49.383Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-10T09:33:31.854Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T08:39:24.906Z","stale":false,"partial":false}}