CVE-2023-35921
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability has been identified in SIMATIC MV540 H, MV540 S, MV550 H, MV550 S, MV560 U, and MV560 X devices in versions below V3.3.4. These devices cannot properly process specially crafted Ethernet frames, which could allow an unauthenticated remote attacker to cause a denial of service condition.
Risk Assessment
This vulnerability may lead to service outages, affecting the availability of systems within the organization. It requires manual restart of the devices, potentially causing additional downtime.
Recommendation
It is recommended to update all affected devices to version V3.3.4 or newer to mitigate the risk of this vulnerability.
Other vulnerabilities in SIMATIC MV540 H, MV540 S, MV550 H, MV550 S, MV560 U, MV560 X (wszystkie wersje < V3.3.4)
See all- CVE-2023-36521High
A vulnerability has been identified in SIMATIC MV540 H, MV540 S, MV550 H, MV550 S, MV560 U, and MV560 X products in versions below V3.3.4. The result synchronization server contains a vulnerability that may lead to a denial of service condition.
- CVE-2023-35920High
A vulnerability has been identified in SIMATIC MV540 H, MV540 S, MV550 H, MV550 S, MV560 U, and MV560 X devices in versions below V3.3.4. These devices cannot properly process specially crafted IP packets, which could allow an unauthenticated remote attacker to cause a denial of service condition.
Original NVD description (English source)
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). Affected devices cannot properly process specially crafted Ethernet frames sent to the devices. This could allow an unauthenticated remote attacker to cause a denial of service condition. The affected devices must be restarted manually.