CVE-2014-2251

Severity: high (CVSS 8.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-03-16 · updated 2026-06-17

Description

The random-number generator on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 does not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic protection mechanisms and hijack sessions via unspecified vectors.

Affected products

Siemens Simatic S7-1500 Cpu Firmware: through 1.1.2; 1.0.1, 1.1.0, 1.1.1

References

http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf
http://ics-cert.us-cert.gov/advisories/ICSA-14-073-01
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-456423.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-456423.pdf

Get alerted when CVE-2014-2251 or the next vulnerability affects your stack