CVE-2018-13805 Denial of service in SIMATIC ET 200SP Open Controller
An attacker can cause a denial-of-service condition on Siemens PLCs by sending crafted packets, disrupting network communication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-13805?
CVE-2018-13805 is a high-severity denial of service vulnerability in Siemens AG SIMATIC ET 200SP Open Controller, published on 10 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 incl. F (All versions >= V2.0 and < V2.5). An attacker can cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to communicate over the network. This vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. An attacker could use this vulnerability to compromise availability of the network connectivity. At the time of advisory publication no public exploitation of this vulnerability was known.
Weakness: CWE-400
Which versions are affected by CVE-2018-13805?
It affects 3 products.
Products include Siemens Simatic Et 200sp Firmware, Siemens Simatic S7-1500 Firmware, Siemens Simatic S7-1500f Firmware.
How do I fix CVE-2018-13805?
No fix has been published for CVE-2018-13805 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-13805 being exploited?
There is no known exploitation of CVE-2018-13805 in the wild and no public exploit code.
Sources
Also known as GHSA-mxvx-9h7h-6vxh.