What’s Vulnerable › Vulnerabilities

CVE-2024-23814

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-11 · updated 2026-06-17
• Weakness: CWE-400

Description

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re-assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service condition of the ICMP service, other communication services are not affected. Affected devices will resume normal operation after the attack terminates.

Affected products

• Siemens SIDOOR ATD430W: all versions
• Siemens SIDOOR ATE530G COATED: all versions
• Siemens SIDOOR ATE530S COATED: all versions
• Siemens SIMATIC CFU DIQ: before V2.0.0 — fixed in V2.0.0
• Siemens SIMATIC CFU PA: before V2.0.0; before V2.0 — fixed in V2.0, V2.0.0
• Siemens SIMATIC ET 200AL IM 157-1 PN: all versions
• Siemens SIMATIC ET 200M IM 153-4 PN IO HF: all versions
• Siemens SIMATIC ET 200M IM 153-4 PN IO ST: all versions
• Siemens SIMATIC ET 200MP IM 155-5 PN BA: all versions
• Siemens SIMATIC ET 200MP IM 155-5 PN HF: all versions
• Siemens SIMATIC ET 200MP IM 155-5 PN ST: all versions
• Siemens SIMATIC ET 200pro IM 154-3 PN HF: all versions
• Siemens SIMATIC ET 200pro IM 154-4 PN HF: all versions
• Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU: all versions
• Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU: all versions
• Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU: all versions
• Siemens SIMATIC ET 200S IM 151-3 PN FO: all versions
• Siemens SIMATIC ET 200S IM 151-3 PN HF: all versions
• Siemens SIMATIC ET 200S IM 151-3 PN HS: all versions
• Siemens SIMATIC ET 200S IM 151-3 PN ST: all versions
• Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU: all versions
• Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU: all versions
• Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: all versions
• Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: all versions
• Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: all versions
• Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: all versions
• Siemens SIMATIC ET 200SP IM 155-6 MF HF: all versions
• Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF: all versions
• Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF: all versions
• Siemens SIMATIC ET 200SP IM 155-6 PN BA: all versions

How to fix

Upgrade to a fixed version: Siemens SIMATIC CFU DIQ V2.0.0; Siemens SIMATIC CFU PA V2.0, V2.0.0; Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) V1.3; Siemens SIMATIC PN/PN Coupler V6.0.0; Siemens SIMATIC S7-1200 CPU 1211C AC/DC/Rly V4.4; Siemens SIMATIC S7-1200 CPU 1211C DC/DC/DC V4.4; Siemens SIMATIC S7-1200 CPU 1211C DC/DC/Rly V4.4; Siemens SIMATIC S7-1200 CPU 1212C AC/DC/Rly V4.4; Siemens SIMATIC S7-1200 CPU 1212C DC/DC/DC V4.4; Siemens SIMATIC S7-1200 CPU 1212C DC/DC/Rly V4.4; Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/DC V4.4; Siemens SIMATIC S7-1200 CPU 1212FC DC/DC/Rly V4.4. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/html/ssa-725549.html
• https://cert-portal.siemens.com/productcert/html/ssa-769027.html

Get alerted when CVE-2024-23814 or the next vulnerability affects your stack