ICSA-17-129-02: Siemens PROFINET DCP (Update V)
CISA advisory · released 2017-05-08
Source record Collected from CISA's CSAF advisory feed
- Distribution label in the document: TLP:WHITE
- Revision 27, 2024-09-10 (final)
CISA's summary
Summary: Several industrial devices are affected by two vulnerabilities that could allow an attacker to cause a denial of service condition via PROFINET DCP network packets under certain circumstances. The precondition for this scenario is a direct layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Products, as the advisory lists them
| Vendor | Product | Version |
|---|---|---|
| Siemens | Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller | <V4.1.1_Patch04 |
| Siemens | Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 | <V4.2.1_Patch03 |
| Siemens | Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P | <V4.4.0_Patch01 |
| Siemens | IE/AS-i Link PN IO | vers:all/* |
| Siemens | IE/PB-Link (incl. SIPLUS NET variants) | vers:all/<V3.0 |
| Siemens | SCALANCE M-800 family (incl. S615, MUM-800 and RM1224) | vers:all/<V4.03 |
| Siemens | SCALANCE W-700 IEEE 802.11n family | vers:all/<V6.1 |
| Siemens | SCALANCE X408 family | vers:all/<V4.1.0 |
| Siemens | SCALANCE X414 | vers:all/<V3.10.2 |
| Siemens | SCALANCE X-200 family (incl. SIPLUS NET variants) | vers:all/<V5.2.2 |
| Siemens | SCALANCE X-200IRT family (incl. SIPLUS NET variants) | vers:all/<V5.4.0 |
| Siemens | SCALANCE X-300 family (incl. X408 and SIPLUS NET variants) | vers:all/<V4.1.0 |
| Siemens | SCALANCE XM-400 family | vers:all/<V6.1 |
| Siemens | SCALANCE XR-500 family | vers:all/<V6.1 |
| Siemens | SIMATIC CM 1542-1 | vers:all/<V2.0 |
| Siemens | SIMATIC CM 1542SP-1 | vers:all/<V1.0.15 |
| Siemens | SIMATIC CP 343-1 (incl. SIPLUS variants) | vers:all/<V3.1.3 |
| Siemens | SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) | vers:all/* |
| Siemens | SIMATIC CP 343-1 Lean (incl. SIPLUS variants) | vers:all/<V3.1.3 |
| Siemens | SIMATIC CP 443-1 (incl. SIPLUS variants) | vers:all/<V3.2.17 |
| Siemens | SIMATIC CP 443-1 Advanced (incl. SIPLUS variants) | vers:all/<V3.2.17 |
| Siemens | SIMATIC CP 443-1 OPC UA (6GK7443-1UX00-0XE0) | vers:all/* |
| Siemens | SIMATIC CP 1243-1 (incl. SIPLUS variants) | vers:all/<V2.1.82 |
| Siemens | SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) | vers:all/* |
| Siemens | SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) | vers:all/* |
| Siemens | SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) | vers:all/<V2.1.82 |
| Siemens | SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants) | vers:all/<V1.0.15 |
| Siemens | SIMATIC CP 1543-1 (incl. SIPLUS variants) | vers:all/<V2.1 |
| Siemens | SIMATIC CP 1543SP-1 (incl. SIPLUS variants) | vers:all/<V1.0.15 |
| Siemens | SIMATIC CP 1604 (6GK1160-4AA01) | vers:all/<V2.7 |
| Siemens | SIMATIC CP 1616 (6GK1161-6AA02) | vers:all/<V2.7 |
| Siemens | SIMATIC DK-16xx PN IO | vers:all/<V2.7 |
| Siemens | SIMATIC ET200ecoPN, 4AO U/I 4xM12 (6ES7145-6HD00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12 (6ES7147-6BG00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12 (6ES7142-6BR00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12 (6ES7144-6KD50-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12 (6ES7144-6KD00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12 (6ES7141-6BF00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12 (6ES7141-6BG00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12 (6ES7142-6BF50-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12 (6ES7142-6BF00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12 (6ES7142-6BG00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12 (6ES7141-6BH00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12 (6ES7142-6BH00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200ecoPN: IO-Link Master (6ES7148-6JA00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET200S (incl. SIPLUS variants) | vers:all/* |
| Siemens | SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) | vers:all/<V1.0.2 |
| Siemens | SIMATIC ET 200M (incl. SIPLUS variants) | vers:all/* |
| Siemens | SIMATIC ET 200MP IM 155-5 PN BA (6ES7155-5AA00-0AA0) | vers:all/<V4.0.1 |
| Siemens | SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) | vers:all/<V4.2.0 |
| Siemens | SIMATIC ET 200MP IM 155-5 PN ST (6ES7155-5AA00-0AB0) | vers:all/<V4.1.0 |
| Siemens | SIMATIC ET 200pro IM 154-3 PN HF (6ES7154-3AB00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET 200pro IM 154-4 PN HF (6ES7154-4AB10-0AB0) | vers:all/* |
| Siemens | SIMATIC ET 200SP IM 155-6 PN BA (6ES7155-6AR00-0AN0) | vers:all/* |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0) | vers:all/<V4.2.0 |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HS (6ES7155-6AU00-0DN0) | vers:all/<V4.0.1 |
| Siemens | SIMATIC ET 200SP IM 155-6 PN ST (6ES7155-6AU00-0BN0) | vers:all/<V4.1.0 |
| Siemens | SIMATIC ET 200SP IM 155-6 PN ST BA (6ES7155-6AA00-0BN0) | vers:all/<V4.1.0 |
| Siemens | SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels (incl. SIPLUS variants) | vers:all/<V15.1 |
| Siemens | SIMATIC MV420 SR-B (6GF3420-0AA20) | vers:all/<V7.0.6 |
| Siemens | SIMATIC MV420 SR-B Body (6GF3420-0AX20) | vers:all/<V7.0.6 |
| Siemens | SIMATIC MV420 SR-P (6GF3420-0AA40) | vers:all/<V7.0.6 |
| Siemens | SIMATIC MV420 SR-P Body (6GF3420-0AX40) | vers:all/<V7.0.6 |
| Siemens | SIMATIC MV440 HR (6GF3440-1GE10) | vers:all/<V7.0.6 |
| Siemens | SIMATIC MV440 SR (6GF3440-1CD10) | vers:all/<V7.0.6 |
| Siemens | SIMATIC MV440 UR (6GF3440-1LE10) | vers:all/<V7.0.6 |
| Siemens | SIMATIC PN/PN Coupler (incl. SIPLUS NET variants) | vers:all/<V4.0 |
| Siemens | SIMATIC RF650R (6GT2811-6AB20) | vers:all/<V3.0 |
| Siemens | SIMATIC RF680R (6GT2811-6AA10) | vers:all/<V3.0 |
| Siemens | SIMATIC RF685R (6GT2811-6CA10) | vers:all/<V3.0 |
| Siemens | SIMATIC S7-200 SMART | vers:all/<V2.3 |
| Siemens | SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) | <V3.X.14 |
| Siemens | SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) | vers:all/<V6.0.7 |
| Siemens | SIMATIC S7-400 PN/DP V6 CPU family (incl. SIPLUS variants) | vers:all/<V6.0.6 |
| Siemens | SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) | vers:all/<V7.0.2 |
| Siemens | SIMATIC S7-410 CPU family (incl. SIPLUS variants) | vers:all/<V8.2 |
| Siemens | SIMATIC S7-1200 CPU family (incl. SIPLUS variants) | vers:all/<V4.2.1 |
| Siemens | SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) | vers:all/<V2.1 |
| Siemens | SIMATIC S7-1500 Software Controller | vers:all/<V2.1 |
| Siemens | SIMATIC TDC CP51M1 | vers:all/<V1.1.8 |
| Siemens | SIMATIC TDC CPU555 | vers:all/<V1.1.1 |
| Siemens | SIMATIC Teleservice Adapter IE Advanced | vers:all/* |
| Siemens | SIMATIC Teleservice Adapter IE Basic | vers:all/* |
| Siemens | SIMATIC Teleservice Adapter IE Standard | vers:all/* |
| Siemens | SIMATIC WinAC RTX 2010 (6ES7671-0RC08-0YA0) | <V2010_SP3 |
| Siemens | SIMATIC WinAC RTX F 2010 (6ES7671-1RC08-0YA0) | <V2010_SP3 |
| Siemens | SIMOCODE pro V PROFINET (incl. SIPLUS variants) | vers:all/<V2.0.0 |
| Siemens | SIMOTION | <V4.5_HF1 |
| Siemens | SINAMICS DCM w. PN | <V1.4_SP1_HF5 |
| Siemens | SINAMICS DCP w. PN | <V1.2_HF1 |
| Siemens | SINAMICS G110M w. PN | <V4.7_SP6_HF3 |
| Siemens | SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants) | <V4.7_SP6_HF3 |
| Siemens | SINAMICS G130 V4.7 w. PN | <V4.7_HF27 |
| Siemens | SINAMICS G130 V4.8 w. PN | <V4.8_HF4 |
| Siemens | SINAMICS G150 V4.7 w. PN | <V4.7:_V4.7_HF27 |
| Siemens | SINAMICS G150 V4.8 w. PN | <V4.8_HF4 |
| Siemens | SINAMICS S110 w. PN | <V4.4_SP3_HF5 |
| Siemens | SINAMICS S120 prior to V4.7 w. PN (incl. SIPLUS variants) | vers:all/<V4.7 |
| Siemens | SINAMICS S120 V4.7 SP1 w. PN (incl. SIPLUS variants) | vers:all/* |
| Siemens | SINAMICS S120 V4.7 w. PN (incl. SIPLUS variants) | <V4.7_HF27 |
| Siemens | SINAMICS S120 V4.8 w. PN (incl. SIPLUS variants) | <V4.8_HF4 |
| Siemens | SINAMICS S150 V4.7 w. PN | <V4.7_HF27 |
| Siemens | SINAMICS S150 V4.8 w. PN | <V4.8_HF4 |
| Siemens | SINAMICS V90 w. PN | vers:all/<V1.01 |
| Siemens | SINUMERIK 828D V4.5 and prior | <V4.5_SP6_HF2 |
| Siemens | SINUMERIK 828D V4.7 | <V4.7_SP4_HF1 |
| Siemens | SINUMERIK 840D sl V4.5 and prior | <V4.5_SP6_HF2 |
| Siemens | SINUMERIK 840D sl V4.7 | <V4.7_SP4_HF1 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) | vers:all/<V4.2.0 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) | vers:all/<V4.2.0 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) | vers:all/<V4.2.0 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN ST (6AG1155-5AA00-7AB0) | vers:all/<V4.1.0 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN ST TX RAIL (6AG2155-5AA00-4AB0) | vers:all/<V4.1.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-2CN0) | vers:all/<V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-4CN0) | vers:all/<V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU00-1CN0) | vers:all/<V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN ST (6AG1155-6AU00-7BN0) | vers:all/<V4.1.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN ST BA (6AG1155-6AA00-7BN0) | vers:all/<V4.1.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL (6AG2155-6AA00-4BN0) | vers:all/<V4.1.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN ST TX RAIL (6AG2155-6AU00-4BN0) | vers:all/<V4.1.0 |
| Siemens | SIRIUS ACT 3SU1 interface module PROFINET | vers:all/<V1.1.0 |
| Siemens | SIRIUS Motor Starter M200D PROFINET | vers:all/* |
| Siemens | SIRIUS Soft Starter 3RW44 PN | vers:all/* |
| Siemens | SITOP PSU8600 PROFINET | vers:all/<V1.2.0 |
| Siemens | SITOP UPS1600 PROFINET (incl. SIPLUS variants) | vers:all/<V2.2.0 |
| Siemens | Softnet PROFINET IO for PC-based Windows systems | <V14_SP1 |
DeSpy has not checked any unit, hardware revision or firmware.
Vulnerabilities in this advisory
- CVE-2017-2680 — CVE-2017-2680 · CWE-400
Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected.
- CVE-2017-2681 — CVE-2017-2681 · CWE-400
Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.
Acknowledgments, as the advisory lists them
- Siemens ProductCERT: reporting these vulnerabilities to CISA.
The advisory's legal notice
Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.
Sources
DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.