CVE-2011-20002
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | simatic_s7-1200_cpu_v2 | * |
| siemens | simatic_s7-1200_cpu_v1 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-294 | A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2011-20002 is a capture-replay vulnerability affecting Siemens SIMATIC S7-1200 CPU V1 and V2 family controllers. An attacker positioned between the engineering software and the controller can record legitimate commands sent to the controller and replay them later to execute unauthorized actions, such as setting the controller to STOP. This attack can be performed regardless of whether the controller has a password configured. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute previously recorded commands on the controller at a later time, potentially disrupting industrial processes by stopping the controller or causing other unauthorized actions. This can lead to operational downtime, safety risks, and loss of control over critical industrial systems. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability CVE-2011-20002 involves capture-replay attacks on communication between the engineering software and the SIMATIC S7-1200 CPU controllers. Detection would involve monitoring network traffic for repeated or replayed command sequences between the engineering software and the controller. Specific commands are not provided in the resources, but network traffic analysis tools (e.g., Wireshark) could be used to capture and analyze communication patterns for replayed commands. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2011-20002, Siemens recommends updating affected SIMATIC S7-1200 CPU V1 and V2 family controllers to firmware version V2.0.2 or later. Additionally, general security best practices should be followed, such as protecting network access with appropriate mechanisms and configuring the operational environment according to Siemens' Industrial Security guidelines. [1]