CVE-2025-40944
Improper Session Handling in SIMATIC ET 200 Causes DoS
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | simatice_t_200al_im_157-1_pn | 6es7157-1ab00-0ab0 |
| siemens | simatice_t_200mp_im_155-5_pn_hf | From 4.2.0 (inc) |
| siemens | simatice_t_200sp_im_155-6_mf_hf | 6es7155-6mu00-0cn0 |
| siemens | simatice_t_200sp_im_155-6_pn_ha | to 1.3 (exc) |
| siemens | simatice_t_200sp_im_155-6_pn_r1 | to 6.0.1 (exc) |
| siemens | simatice_t_200sp_im_155-6_pn_3_hf | to 4.2.2 (exc) |
| siemens | simatice_tn_mf_coupler | 6es7158-3mu10-0xa0 |
| siemens | simatice_tn_pn_coupler | to 6.0.0 (exc) |
| siemens | siplus_et_200mp_im_155-5_pn_hf | From 4.2.0 (inc) |
| siemens | siplus_et_200mp_im_155-5_pn_hf_t1_rail | From 4.2.0 (inc) |
| siemens | siplus_et_200sp_im_155-6_pn_hf | From 4.2.0 (inc) |
| siemens | siplus_et_200sp_im_155-6_pn_hf_t1_rail | From 4.2.0 (inc) |
| siemens | siplus_et_200sp_im_155-6_pn_hf_tx_rail | From 4.2.0 (inc) |
| siemens | siplus_net_pn_pn_coupler | to 6.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects various Siemens SIMATIC ET 200 series interface modules and couplers. It occurs because the affected devices do not properly handle valid S7 protocol Disconnect Requests (COTP DR TPDU) received on TCP port 102. When such a disconnect request is received, the devices enter an improper session state, causing them to become unresponsive. Recovery requires a power cycle to restore normal operation. [1]
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to cause a denial-of-service (DoS) condition by sending valid S7 protocol Disconnect Requests to the affected devices. This makes the devices unresponsive and disrupts their normal operation until they are power cycled. This can lead to downtime and interruption of industrial network communications, potentially impacting operational continuity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for valid S7 protocol Disconnect Requests (COTP DR TPDU) on TCP port 102 sent to affected Siemens devices. Network administrators can use packet capture tools such as Wireshark or tcpdump to filter and analyze traffic on TCP port 102 for these disconnect requests. For example, a tcpdump command to capture such traffic could be: tcpdump -i <interface> tcp port 102 and tcp[13] & 0x03 == 0x01 (to filter COTP Disconnect Requests). Additionally, checking device responsiveness and logs for unexpected session disconnects or unresponsiveness may help identify exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting network access to the affected devices by filtering TCP port 102 to allow only trusted IP addresses, typically using external firewalls. For devices with available firmware updates, apply the recommended updates to versions that fix the vulnerability (e.g., update SIMATIC ET 200SP IM 155-6 PN HA to V1.3 or later, IM 155-6 PN R1 to V6.0.1 or later, IM 155-6 PN/3 HF to V4.2.2 or later, and PN/PN Coupler to V6.0.0 or later). For devices without available fixes, rely on network segmentation and access control to prevent unauthorized access to the S7 communication port. Additionally, follow Siemens' Industrial Security operational guidelines to protect device network access. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.