Siemens SIMATIC s7-200 Smart CPU SR30 vulnerabilities

3 CVEs affecting Siemens SIMATIC s7-200 Smart CPU SR30, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40820, published 2025-12-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-43647, published 2024-09-10. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU…
CVE-2025-40820, published 2025-12-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to…
CVE-2024-35292, published 2024-06-11. High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability has been identified in SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) (All versions), SIMATIC S7-200 SMART CPU CR60 (6ES7288-1CR60-0AA0) (All versions), SIMATIC S7-200 SMART CPU…