#VU60532 Memory leak in Siemens products - CVE-2021-37205

Vulnerability identifier: #VU60532

Vulnerability risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-37205

CWE-ID: CWE-401

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
SIMATIC ET 200SP Open Controller CPU 1515SP PC2
Server applications / SCADA systems
SIMATIC S7-1500 Software Controller
Server applications / SCADA systems
SIMATIC S7-PLCSIM Advanced
Server applications / SCADA systems
SIMATIC S7-1200 CPU family
Hardware solutions / Firmware
SIMATIC S7-1500 CPU
Hardware solutions / Firmware
SIMATIC Drive Controller
Hardware solutions / Firmware
SIMATIC TIM 1531 IRC
Hardware solutions / Firmware

Vendor: Siemens

Description

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in a PLC. A remote attacker can force the application to leak memory and perform denial of service attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

SIMATIC ET 200SP Open Controller CPU 1515SP PC2: All versions

SIMATIC S7-1200 CPU family: 4.5 - 4.5.1

SIMATIC S7-1500 CPU: 2.9.2 - 2.9.3

SIMATIC S7-1500 Software Controller: All versions

SIMATIC S7-PLCSIM Advanced: All versions

SIMATIC Drive Controller: before 2.9.4

SIMATIC TIM 1531 IRC: before 2.2

---

External links
https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.