ICSA-25-294-03: Siemens SIMATIC S7-1200 CPU V1/V2 Devices

CISA's summary

Summary: SIMATIC S7-1200 CPU V1/V2 controllers contain two vulnerabilities that could allow an unauthenticated remote attacker - to trigger functions by record and playback of legitimate network communication, or - to place the controller in stop/defect state by causing a communications error. Siemens has released new versions for the affected products and recommends to update to the latest versions.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2011-20001 — CVE-2011-20001 · CWE-20

  The web server interface of affected devices improperly processes incoming malformed HTTP traffic at high rate. This could allow an unauthenticated remote attacker to force the device entering the stop/defect state, thus creating a denial of service condition.

• CVE-2011-20002 — CVE-2011-20002 · CWE-294

  Affected controllers are vulnerable to capture-replay in the communication with the engineering software. This could allow an on-path attacker between the engineering software and the controller to execute any previously recorded commands at a later time (e.g. set the controller to STOP), regardless whether or not the controller had a password configured.

Acknowledgments, as the advisory lists them

• Artem Zinenko, Kaspersky: reporting these vulnerabilities to Siemens.
• Dillon Beresford, NSS Labs: reporting these vulnerabilities to Siemens.

The advisory's legal notice

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.