CVE-2014-2250

Severity: high (CVSS 8.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-24 · updated 2026-06-17
Weakness: CWE-310

Description

The random-number generator on Siemens SIMATIC S7-1200 CPU PLC devices with firmware before 4.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors, a different vulnerability than CVE-2014-2251.

Affected products

Siemens Simatic S7 Cpu-1211C: all versions
Siemens Simatic S7 Cpu 1200 Firmware: through 3.0.2; 3.0
Siemens Simatic S7 Cpu 1212C: all versions
Siemens Simatic S7 Cpu 1214C: all versions
Siemens Simatic S7 Cpu 1215C: all versions
Siemens Simatic S7 Cpu 1217C: all versions

References

http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf
http://ics-cert.us-cert.gov/advisories/ICSA-14-079-02
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-654382.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-654382.pdf

Get alerted when CVE-2014-2250 or the next vulnerability affects your stack