CVE-2022-25622: Siemens SIMATIC Cfu Diq Firmware

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.

Affected products

• Siemens SIMATIC Cfu Diq Firmware: any version
• Siemens SIMATIC Cfu Pa Firmware: any version
• Siemens SIMATIC s7-1500 CPU Firmware: before 2.0.0 (fixed in 2.0.0)
• Siemens SIMATIC s7-300 CPU Firmware: any version
• Siemens SIMATIC s7-400 Pn/dp v7 Firmware: any version
• Siemens SIMATIC s7-400h v6 Firmware: any version
• Siemens SIMATIC s7-410 v10 Firmware: any version
• Siemens SIMATIC s7-410 v8 Firmware: any version
• Siemens SIMATIC Tdc CP51M1 Firmware: any version
• Siemens SIMATIC Tdc CPU555 Firmware: any version
• Siemens SIMATIC Winac Rtx Firmware: any version
• Siemens Simit Simulation Platform: any version

Published 2022-04-12. Last modified 2026-06-17.