CVE-2021-37185 : What You Need to Know

A vulnerability has been identified in SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2, SIMATIC S7-1200 CPU family, SIMATIC S7-1500 CPU family, SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SIPLUS TIM 1531 IRC, and TIM 1531 IRC. An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp.

Understanding CVE-2021-37185

This section provides an overview of the CVE-2021-37185 vulnerability.

What is CVE-2021-37185?

A vulnerability in multiple Siemens products could allow an unauthenticated attacker to trigger a denial-of-service condition by sending malicious packets to port 102/tcp.

The Impact of CVE-2021-37185

The impact of this vulnerability is that it could lead to a denial-of-service condition in affected devices, requiring a restart to restore normal operations.

Technical Details of CVE-2021-37185

Here are the technical details of the CVE-2021-37185 vulnerability.

Vulnerability Description

The vulnerability allows an unauthenticated attacker to disrupt PLC operations by sending specially crafted packets to port 102/tcp.

Affected Systems and Versions

SIMATIC Drive Controller family: All versions >= V2.9.2 < V2.9.4
SIMATIC ET 200SP Open Controller CPU 1515SP PC2: All versions >= V21.9 < V21.9.4
SIMATIC S7-1200 CPU family: All versions >= V4.5.0 < V4.5.2
SIMATIC S7-1500 CPU family: All versions >= V2.9.2 < V2.9.4
SIMATIC S7-1500 Software Controller: All versions >= V21.9 < V21.9.4
SIMATIC S7-PLCSIM Advanced: All versions >= V4.0 < V4.0 SP1
SIPLUS TIM 1531 IRC: All versions < V2.3.6
TIM 1531 IRC: All versions < V2.3.6

Exploitation Mechanism

The vulnerability can be exploited by an unauthenticated attacker sending specially prepared packets over port 102/tcp to cause a denial-of-service condition.

Mitigation and Prevention

Learn how to protect your systems from the CVE-2021-37185 vulnerability.

Immediate Steps to Take

It is recommended to apply security updates provided by Siemens to mitigate the vulnerability. Additionally, restrict network access to affected devices.

Long-Term Security Practices

Implement network segmentation, restrict access to critical systems, and regularly update and patch your devices to maintain a secure environment.

Patching and Updates

Refer to the Siemens product security advisory for specific patches and updates to address CVE-2021-37185.