CVE-2022-40227

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-11 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V17 Update 4), SIMATIC HMI KTP Mobile Panels (All versions < V17 Update 4), SIMATIC HMI KTP1200 Basic (All versions < V17 Update 5), SIMATIC HMI KTP400 Basic (All versions < V17 Update 5), SIMATIC HMI KTP700 Basic (All versions < V17 Update 5), SIMATIC HMI KTP900 Basic (All versions < V17 Update 5), SIPLUS HMI KTP1200 BASIC (All versions < V17 Update 5), SIPLUS HMI KTP400 BASIC (All versions < V17 Update 5), SIPLUS HMI KTP700 BASIC (All versions < V17 Update 5), SIPLUS HMI KTP900 BASIC (All versions < V17 Update 5). Affected devices do not properly validate input sent to certain services over TCP. This could allow an unauthenticated remote attacker to cause a permanent denial of service condition (requiring a device reboot) by sending specially crafted TCP packets.

Affected products

Siemens Simatic Hmi Comfort Panels Firmware: before 17.0; 17.0, 17.0-update1, 17.0-update2, 17.0-update3 — fixed in 17.0
Siemens Simatic Hmi Ktp1200 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Simatic Hmi Ktp400 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Simatic Hmi Ktp700 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Simatic Hmi Ktp900 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Simatic Hmi Ktp Mobile Panels Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3 — fixed in 17.0
Siemens Siplus Hmi Ktp1200 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Siplus Hmi Ktp400 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Siplus Hmi Ktp700 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0
Siemens Siplus Hmi Ktp900 Basic Firmware: before 17.0; 17.0, 17.0-udpate1, 17.0-update2, 17.0-update3, 17.0-update4 — fixed in 17.0

How to fix

Upgrade to a fixed version: Siemens Simatic Hmi Comfort Panels Firmware 17.0; Siemens Simatic Hmi Ktp1200 Basic Firmware 17.0; Siemens Simatic Hmi Ktp400 Basic Firmware 17.0; Siemens Simatic Hmi Ktp700 Basic Firmware 17.0; Siemens Simatic Hmi Ktp900 Basic Firmware 17.0; Siemens Simatic Hmi Ktp Mobile Panels Firmware 17.0; Siemens Siplus Hmi Ktp1200 Basic Firmware 17.0; Siemens Siplus Hmi Ktp400 Basic Firmware 17.0; Siemens Siplus Hmi Ktp700 Basic Firmware 17.0; Siemens Siplus Hmi Ktp900 Basic Firmware 17.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-40227 or the next vulnerability affects your stack