ICSA-22-104-06: Siemens PROFINET Stack Integrated on Interniche Stack
CISA advisory · released 2022-04-12
Source record Collected from CISA's CSAF advisory feed
- Distribution label in the document: TLP:WHITE
- Revision 14, 2025-01-14 (final)
CISA's summary
Summary: The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, contains a vulnerability that could allow an attacker to cause a denial of service condition on affected industrial products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
Products, as the advisory lists them
| Vendor | Product | Version |
|---|---|---|
| Siemens | SIMATIC CFU DIQ (6ES7655-5PX31-1XX0) | vers:all/<V2.0.0 |
| Siemens | SIMATIC CFU PA (6ES7655-5PX11-0XX0) | vers:all/<V2.0.0 |
| Siemens | SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L (6ES7144-6JF00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L (6ES7148-6JE00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JG00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JJ00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, DI 8x24VDC, M12-L (6ES7141-6BG00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, DI 16x24VDC, M12-L (6ES7141-6BH00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L (6ES7143-6BH00-0BB0) | vers:all/>=V5.1.1|<V5.1.3 |
| Siemens | SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L (6ES7142-6BG00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L (6ES7142-6BR00-0BB0) | vers:all/>=V5.1.1|<V5.1.2 |
| Siemens | SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) | vers:all/* |
| Siemens | SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) | vers:all/>=V4.2.0 |
| Siemens | SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) | vers:all/* |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) | vers:all/* |
| Siemens | SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0) | vers:all/>=V4.2.0 |
| Siemens | SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) | vers:all/>=V4.2.0 |
| Siemens | SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) | vers:all/>=V4.2.0 |
| Siemens | SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) | vers:all/* |
| Siemens | SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) | vers:all/>=4.2 |
| Siemens | SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) | vers:all/<V3.3.19 |
| Siemens | SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0) | vers:all/<V3.2.19 |
| Siemens | SIMATIC S7-400 CPU 412-2 PN V7 (6ES7412-2EK07-0AB0) | vers:all/* |
| Siemens | SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0) | vers:all/* |
| Siemens | SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0) | vers:all/* |
| Siemens | SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0) | vers:all/* |
| Siemens | SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0) | vers:all/* |
| Siemens | SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) | vers:all/<V6.0.10 |
| Siemens | SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) | vers:all/<V8.2.3 |
| Siemens | SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants) | vers:all/<V10.1.1 |
| Siemens | SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) | vers:all/<V2.0.0 |
| Siemens | SIMATIC TDC CP51M1 | vers:all/<V1.1.10 |
| Siemens | SIMATIC TDC CPU555 | vers:all/<V1.2.1 |
| Siemens | SIMATIC WinAC RTX 2010 (6ES7671-0RC08-0YA0) | vers:all/* |
| Siemens | SIMATIC WinAC RTX F 2010 (6ES7671-1RC08-0YA0) | vers:all/* |
| Siemens | SINAMICS DCM | <V1.5_SP1_with_Ethernet_interface |
| Siemens | SINAMICS G110M | vers:all/<V4.7.14 |
| Siemens | SINAMICS G115D | vers:all/<V4.7.14 |
| Siemens | SINAMICS G120 (incl. SIPLUS variants) | <V4.7_SP14_with_Ethernet_interface |
| Siemens | SINAMICS G130 | vers:all/<V5.2.3.13 |
| Siemens | SINAMICS G150 | vers:all/<V5.2.3.13 |
| Siemens | SINAMICS S110 | vers:all/* |
| Siemens | SINAMICS S120 (incl. SIPLUS variants) | <V5.2_SP3_HF13 |
| Siemens | SINAMICS S150 | vers:all/<V5.2.3.13 |
| Siemens | SINAMICS S210 (6SL5...) | <V5.2_SP3_HF18 |
| Siemens | SINAMICS V90 | vers:all/<V1.04.04 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200S IM 151-8 PN/DP CPU (6AG1151-8AB01-7AB0) | vers:all/<V3.2.19 |
| Siemens | SIPLUS ET 200S IM 151-8F PN/DP CPU (6AG1151-8FB01-2AB0) | vers:all/<V3.2.19 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-2CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU00-4CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU00-1CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) | vers:all/>=V4.2.0 |
| Siemens | SIPLUS HCS4200 CIM4210 (6BK1942-1AA00-0AA0) | vers:all/* |
| Siemens | SIPLUS HCS4200 CIM4210C (6BK1942-1AA00-0AA1) | vers:all/* |
| Siemens | SIPLUS HCS4300 CIM4310 (6BK1943-1AA00-0AA0) | vers:all/* |
| Siemens | SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) | vers:all/>=4.2 |
| Siemens | SIPLUS S7-300 CPU 314C-2 PN/DP (6AG1314-6EH04-7AB0) | vers:all/<V3.3.19 |
| Siemens | SIPLUS S7-300 CPU 315-2 PN/DP (6AG1315-2EH14-7AB0) | vers:all/<V3.2.19 |
| Siemens | SIPLUS S7-300 CPU 315F-2 PN/DP (6AG1315-2FJ14-2AB0) | vers:all/<V3.2.19 |
| Siemens | SIPLUS S7-300 CPU 317-2 PN/DP (6AG1317-2EK14-7AB0) | vers:all/<V3.2.19 |
| Siemens | SIPLUS S7-300 CPU 317F-2 PN/DP (6AG1317-2FK14-2AB0) | vers:all/<V3.2.19 |
| Siemens | SIPLUS S7-400 CPU 414-3 PN/DP V7 (6AG1414-3EM07-7AB0) | vers:all/* |
| Siemens | SIPLUS S7-400 CPU 416-3 PN/DP V7 (6AG1416-3ES07-7AB0) | vers:all/* |
DeSpy has not checked any unit, hardware revision or firmware.
Vulnerabilities in this advisory
- CVE-2022-25622 — CVE-2022-25622 · CWE-400
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.
Acknowledgments, as the advisory lists them
- Siemens ProductCERT: reporting this vulnerability to CISA.
The advisory's legal notice
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Sources
DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.