CVE-2023-36521

moderate-risk
Published 2023-07-11

A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of all socket-based communication of the affected products if the result server is enabled.

Do I need to act?

-
0.27% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10 High
NETWORK / LOW complexity

Affected Products (6)

Simatic Mv540 H Firmware
Simatic Mv540 S Firmware
Simatic Mv550 H Firmware
Simatic Mv550 S Firmware
Simatic Mv560 U Firmware
Simatic Mv560 X Firmware

Affected Vendors

Siemens

References (2)

Vendor Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf
Vendor Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf
43
/ 100
moderate-risk
Severity 29/34 · Critical
Exploitability 1/34 · Minimal
Exposure 13/34 · Low