Siemens Industrial Devices Denial of Service Vulnerability Advisory (SSA-392349)

Vulnerability Overview Vulnerability Name: SSA-392349: Denial of Service Vulnerability in Industrial Devices Publication Date: 2026-05-12 Last Update: 2026-05-12 Current Version: V1.0 CVSS v3.1 Base Score: 7.5 CVSS v4.0 Base Score: 8.7 Affected Scope A vulnerability exists in multiple industrial devices that could allow an attacker to cause a denial of service. Affected devices include: IE/P LINK HA (6GK1411-9BB00) IE/PB link PN IO (incl. SIPLUS NET variants) SCALANCE M-800 family (incl. 5815, MUM-800 and RM1224) SCALANCE SC-600 family SCALANCE W-700 IEEE 802.11ax family SCALANCE W-700 IEEE 802.11n family SCALANCE W-1700 IEEE 802.11ac family SCALANCE X-200 family (incl. SIPLUS NET variants) SCALANCE X-300 family (incl. X408 and SIPLUS NET variants) SCALANCE XM-400/XR-500 family SIMATIC CPU DIQ (6ES7655-5PX31-1XX0) SIMATIC CPU PA (6ES7655-5PX11-0XX0) SIMATIC CPU PA (6ES7655-5PX11-1XX0) SIMATIC ET 200SP HA IM155-6 PN SIMATIC S7-300 CPU family (incl. related ET 200 CPUs and SIPLUS variants) SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) SIMATIC S7-410 CPU family (incl. SIPLUS variants) SIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants) SMART UNIT SINAMICS CBE20 SINAMICS G115D SINAMICS G120 family SINAMICS G130/G150/G150/120 family SINAMICS S110 SINAMERIK 840D sl SITOP PSU800 SITOP UPS1600 (incl. SIPLUS variants) Remediation IE/P LINK HA (6GK1411-9BB00): No fix is currently planned. Refer to the migration section for further recommendations. IE/PB link PN IO (incl. SIPLUS NET variants): No fix is currently planned. Refer to the migration section for further recommendations. SCALANCE M-800 family (incl. 5815, MUM-800 and RM1224): Show more details. SCALANCE SC-600 family: Show more details. SCALANCE W-700 IEEE 802.11ax family: Show more details. SCALANCE W-700 IEEE 802.11n family: Show more details. SCALANCE W-1700 IEEE 802.11ac family: Show more details. SCALANCE X-200 family (incl. SIPLUS NET variants): Show more details. SCALANCE X-300 family (incl. X408 and SIPLUS NET variants): Show more details. SCALANCE XM-400/XR-500 family: Show more details. SIMATIC CPU DIQ (6ES7655-5PX31-1XX0): Update to V2.0 or later. Refer to the migration section for further recommendations. SIMATIC CPU PA (6ES7655-5PX11-0XX0): Update to V2.0 or later. Refer to the migration section for further recommendations. SIMATIC CPU PA (6ES7655-5PX11-1XX0): Update to V2.0 or later. Refer to the migration section for further recommendations. SIMATIC ET 200SP HA IM155-6 PN: Update to V1.3 or later. Refer to the migration section for further recommendations. SIMATIC S7-300 CPU family (incl. related ET 200 CPUs and SIPLUS variants): Show more details. SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants): No fix is currently planned. As a mitigation, disable the Ethernet ports on the CPU and use a communication module (e.g., CP) for communication. Refer to the migration section for further recommendations. SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants): Show more details. SIMATIC S7-410 CPU family (incl. SIPLUS variants): Show more details. SIMATIC S7-1500 CPU family (incl. related ET 200 CPUs and SIPLUS variants): Show more details. SMART UNIT: Show more details. SINAMICS CBE20: No fix is currently planned. Refer to the migration section for further recommendations. SINAMICS G115D: No fix is currently planned. Refer to the migration section for further recommendations. SINAMICS G120 family: Show more details. SINAMICS G130/G150/G150/120 family: Show more details. SINAMICS S110: No fix is currently planned. Refer to the migration section for further recommendations. SINAMERIK 840D sl: No fix is currently planned. Refer to the migration section for further recommendations. SITOP PSU800: Show more details. SITOP UPS1600 (incl. SIPLUS variants): Show more details. Mitigations Restrict access to affected systems to trusted IP addresses only. Product-specific fixes or mitigations can be found in the "Known Affected Products" section. Please follow general security recommendations. General Security Recommendations It is strongly recommended to implement network access control measures to protect devices in the network with appropriate mechanisms. For operating devices in protected IT environments, it is recommended to configure the environment according to the Siemens Industrial Security Operating Guidelines and follow the recommendations in the product manuals. More information can be found at Industrial Security. Vulnerability Description Vulnerability ID: CVE-2025-40833 Description: The vulnerability involves a null pointer dereference when processing specially crafted IPv4 requests, which could lead to a denial of service. A manual restart of the system is required. CVSS v3.1 Base Score: 7.5 CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS v4.0 Base Score: 8.7 CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/S

Goal Reached Thanks to every supporter — we hit 100%!

Siemens Industrial Devices Denial of Service Vulnerability Advisory (SSA-392349)