Siemens SIMATIC s7-1200 CPU 1215fc Dc/dc/dc vulnerabilities

7 CVEs affecting Siemens SIMATIC s7-1200 CPU 1215fc Dc/dc/dc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40820, published 2025-12-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-23814, published 2025-02-11. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment…
CVE-2025-24811, published 2025-02-11. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/Rly…
CVE-2025-24812, published 2025-02-11. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0) (All versions < V4.7), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0) (All versions < V4.7),…
CVE-2023-37482, published 2025-02-11. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. The login functionality of the web server in affected devices does not normalize the response times of login attempts. An unauthenticated remote attacker could exploit this side-channel information…
CVE-2025-40820, published 2025-12-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to…
CVE-2024-46886, published 2024-10-08. Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days. The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an…
CVE-2024-47100, published 2025-01-14. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (6ES7211-1BE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/DC (6ES7211-1AE40-0XB0), SIMATIC S7-1200 CPU 1211C DC/DC/Rly…