Vulnerability identifier: #VU8067

Vulnerability risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-9945

CWE-ID: CWE-400

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
7KM PAC Switched Ethernet
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: Siemens

Description
The vulnerability allows an adajacent attacker to cause DoS condition on the target system.

The weakness exists in the Siemens 7KM PAC Switched Ethernet PROFINET expansion module due to input validation flaw. An adjacent attacker can send a specially crafted PROFINET DCP packet as a local Ethernet (Layer 2) broadcast, cause memory exhaustion and cause the application to restart.

Successful exploitation of the vulnerability results in denial of service.

Mitigation
Update to version 2.1.3.

Vulnerable software versions

7KM PAC Switched Ethernet: All versions

---

External links
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-771218.pdf

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.