CVE-2021-37204 Denial of service in SIMATIC Drive Controller family

Q: Is CVE-2021-37204 being exploited?

There is no known exploitation of CVE-2021-37204 in the wild and no public exploit code.

Q: How do I fix CVE-2021-37204?

No fix has been published for CVE-2021-37204 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 9 Feb 2022 Updated 18 Apr 2025

An unauthenticated attacker can cause a denial-of-service condition in Siemens PLCs by sending specially crafted packets, requiring a device restart to recover.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-37204?

CVE-2021-37204 is a high-severity denial of service vulnerability in Siemens SIMATIC Drive Controller family, published on 9 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions >= V21.9 < V21.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 Ready4Linux (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions >= V4.5.0 < V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions >= V2.9.2 < V2.9.4), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-1500 Software Controller (All versions >= V21.9 < V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SIMATIC S7-PLCSIM Advanced (All versions >= V4.0 < V4.0 SP1), SIPLUS TIM 1531 IRC (All versions < V2.3.6), TIM 1531 IRC (All versions < V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packet over port 102/tcp. A restart of the affected device is needed to restore normal operations.

Weakness: CWE-672

Which versions are affected by CVE-2021-37204?

It affects 48 products.

Products include Siemens Simatic Drive Controller Cpu 1504d Tf Firmware, Siemens Simatic Drive Controller Cpu 1507d Tf Firmware, Siemens Simatic Et 200sp Open Controller Cpu 1515sp Pc2 Firmware, Siemens Simatic S7-1200 Cpu 1211c Firmware, Siemens Simatic S7-1200 Cpu 1212c Firmware, Siemens Simatic S7-1200 Cpu 1212fc Firmware and 42 more.

How do I fix CVE-2021-37204?

No fix has been published for CVE-2021-37204 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-37204 being exploited?

There is no known exploitation of CVE-2021-37204 in the wild and no public exploit code.

Sources

Also known as GHSA-mw3j-f4pg-723r.