ICSA-20-042-02
·
Published 2025-05-06
·
View on CISA ICS-CERT ↗
Siemens Industrial Products SNMP (Update F)
CVSS 7.5
HIGH
CVEs (2)
Remediations
- Disable SNMP if supported by the product; disabling SNMP fully mitigates the vulnerability
- Protect network access to port 161/udp of affected devices
- Use VPN for protecting network communication between cells
- Migrate to a successor product within the SCALANCE SC-600 family, V2.1 ( https://support.industry.siemens.com/cs/ww/en/view/109780500) or later version
- Currently no fix is planned
- Update to V3.3 or later version
- Update to V4.1 Update is only available via Siemens Support contact
- The updated firmware is contained in SIMATIC NET PC Software V14 Update 14 or later version or SIMATIC NET PC Software V16 or later version
- Update to V1.1.1 or later version
- Update to SIMATIC NET PC Software V16 or later version
- Update to V2.0 or later version
- Update to V4.0.1 or later version
Affected Vendors
Siemens
Affected Products (19)
Siemens
·
IE/PB link PN IO (6GK1411-5AB10)
<V4.0.1
Siemens
·
SCALANCE S602
<V4.1
Siemens
·
SCALANCE S612
<V4.1
Siemens
·
SCALANCE S623
<V4.1
Siemens
·
SCALANCE S627-2M
<V4.1
Siemens
·
SIMATIC CP 1623 (6GK1162-3AA00)
<V14.00.15.00_51.25.00.01
Siemens
·
SIMATIC CP 1626 (6GK1162-6AA01)
<V1.1.1
Siemens
·
SIMATIC CP 1628 (6GK1162-8AA00)
<V14.00.15.00_51.25.00.01
Siemens
·
SIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0)
vers:all/*
Siemens
·
SIMATIC CP 443-1 (6GK7443-1EX30-0XE0)
<V3.3
Siemens
·
SIMATIC CP 443-1 (6GK7443-1EX30-0XE1)
<V3.3
Siemens
·
SIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0)
<V3.3
Siemens
·
SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0)
vers:all/*
Siemens
·
SIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0)
vers:all/*
Siemens
·
SIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0)
<V3.3
Siemens
·
SIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0)
<V3.3
Siemens
·
SIPLUS NET IE/PB link PN IO (6AG1411-5AB10-2AA0)
<V4.0.1
Siemens
·
SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
<V2.0
Siemens
·
TIM 1531 IRC (6GK7543-1MX00-0XE0)
<V2.0
Affected Sectors
Multiple
Get alerted to advisories like this
OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.
Start free trial Learn more