Medium severity · published Dec 17, 2016
CVE-2016-9159
A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl
5.9
CVSS
1.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions), SIMATIC S7-410 V8 CPU family (All versions), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) (All versions). An attacker with network access to port 102/tcp (ISO-TSAP) or via Profibus could obtain credentials from the PLC if protection-level 2 is configured on the affected devices.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Simatic S7-300 Cpu Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-400 Cpu Firmware · Siemens
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-9159
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-9159
www.securityfocus.com
http://www.securityfocus.com/bid/94820
www.securitytracker.com
http://www.securitytracker.com/id/1037434
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf
ics-cert.us-cert.gov
https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05
www.siemens.com
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf
More from Simatic S7-300 Cpu Firmware
8.8
CVE-2016-8673
A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl
7.5
CVE-2022-25622
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than…
7.5
CVE-2019-19300
A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, KTK ATE530S, SIDOOR…
7.5
CVE-2019-18336
A vulnerability has been identified in SIMATIC S7-300 CPU family (incl
7.5
CVE-2019-10936
Affected devices improperly handle large amounts of specially crafted UDP packets