A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• siemens simatic et 200sp open controller cpu 1515sp pc2 firmware2.5 and later · before 20.8
• siemens simatic s7-1500 cpu 1507s f firmware2.5 and later · before 20.8
• siemens simatic s7-1500 cpu 1507s firmware2.5 and later · before 20.8
• siemens simatic s7-1500 cpu 1508s f firmware2.5 and later · before 20.8
• siemens simatic s7-1500 cpu 1508s firmware2.5 and later · before 20.8
• siemens simatic s7-1500 cpu 1511-1 pn firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1513-1 pn firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1515-2 pn firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1516-3 dp firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1516-3 pn firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1517-3 dp firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1517-3 pn firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1518-4 dp firmware2.5 and later · before 2.8
• siemens simatic s7-1500 cpu 1518-4 pn firmware2.5 and later · before 2.8

Versions reported by the vendor

Affected version ranges reported by the assigning authority (siemens). Independent of NVD's CPE analysis and usually ahead of it.

• Siemens AG SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

  • All versions >= V2.5 and < V20.8affected

• Siemens AG SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

  • All versions >= V2.5 and < V2.8affected

• Siemens AG SIMATIC S7-1500 Software Controller

  • All versions >= V2.5 and < V20.8affected

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.