Siemens SIMATIC s7-1200 Firmware vulnerabilities

10 CVEs affecting Siemens SIMATIC s7-1200 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-28400, published 2021-07-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12741, published 2017-12-26. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually.
CVE-2012-3040, published 2012-10-10. Medium severity, CVSS 4.3. EPSS: 2.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web server on Siemens SIMATIC S7-1200 PLCs 2.x through 3.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
CVE-2013-2780, published 2013-04-22. High severity, CVSS 7.8. EPSS: 2.4% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to UDP port 161 (aka the SNMP port).
CVE-2013-0700, published 2013-04-22. High severity, CVSS 7.8. EPSS: 2.4% chance of exploitation in the next 30 days. Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to TCP port 102 (aka the ISO-TSAP port).
CVE-2020-28400, published 2021-07-13. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered if a large amount of DCP reset packets…
CVE-2018-13815, published 2018-12-13. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacker could exhaust the available connection pool of an affected device by opening…
CVE-2012-3037, published 2012-09-25. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the private key of the SIMATIC CONTROLLER Certification Authority certificate, which allows remote attackers to spoof the S7-1200 web…
CVE-2017-2680, published 2017-05-11. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the…
CVE-2017-2681, published 2017-05-11. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that product. Human interaction is required to…
CVE-2019-13945, published 2019-12-12. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family < V4.x (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU…