{"id":"CVE-2021-37205","aliases":["EUVD-2021-23779","GHSA-78f8-w6wx-97fh"],"status":"published","title":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003c V2.9.4),...","description":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003e= V4.5.0 \u003c V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC S7-1500 Software Controller (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions \u003e= V4.0 \u003c V4.0 SP1), SIPLUS TIM 1531 IRC (All versions \u003c V2.3.6), TIM 1531 IRC (All versions \u003c V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0164,"percentile":0.76576,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-401"],"published":"2022-02-09T15:16:57Z","modified":"2026-06-17T04:00:15Z","products":[{"vendor":"siemens","product":"simatic drive controller family"},{"vendor":"siemens","product":"simatic et 200sp open controller cpu 1515sp pc2 (incl. siplus variants)"},{"vendor":"siemens","product":"simatic s7-1200 cpu family (incl. siplus variants)"},{"vendor":"siemens","product":"simatic s7-1500 cpu family (incl. related et200 cpus and siplus variants)"},{"vendor":"siemens","product":"simatic s7-1500 software controller"},{"vendor":"siemens","product":"simatic s7-plcsim advanced"},{"vendor":"siemens","product":"simatic_drive_controller_cpu_1504d_tf_firmware"},{"vendor":"siemens","product":"simatic_drive_controller_cpu_1507d_tf_firmware"},{"vendor":"siemens","product":"simatic_et_200sp_open_controller_cpu_1515sp_pc2_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1211c_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1212c_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1212fc_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1214c_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1214fc_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1215c_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1215fc_firmware"},{"vendor":"siemens","product":"simatic_s7-1200_cpu_1217c_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1510sp-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1510sp_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1511-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1511c-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1511f-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1511t-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1511tf-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1512c-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1512sp-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1512spf-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1513-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1513f-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1513r-1_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1515-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1515f-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1515r-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1515t-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1515tf-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1516-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1516f-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1516pro-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1516pro_f_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1516t-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1516tf-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1517-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1517f-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1517tf-3_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1518-4_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1518f-4_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1518hf-4_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1518t-4_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_1518tf-4_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_cpu_1513pro-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_cpu_cpu_1513prof-2_firmware"},{"vendor":"siemens","product":"simatic_s7-1500_software_controller"},{"vendor":"siemens","product":"simatic_s7-plcsim_advanced_firmware"},{"vendor":"siemens","product":"siplus tim 1531 irc"},{"vendor":"siemens","product":"tim 1531 irc"},{"vendor":"siemens","product":"tim_1531_irc_firmware"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37205"},{"url":"https://github.com/advisories/GHSA-78f8-w6wx-97fh"}],"sources":{"cve":[{"id":"CVE-2021-37205","description":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003e= V4.5.0 \u003c V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC S7-1500 Software Controller (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions \u003e= V4.0 \u003c V4.0 SP1), SIPLUS TIM 1531 IRC (All versions \u003c V2.3.6), TIM 1531 IRC (All versions \u003c V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.","status":"published","published":"2022-02-09T15:16:57Z","modified":"2025-04-18T18:29:47.038Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-23779","description":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003e= V4.5.0 \u003c V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC S7-1500 Software Controller (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions \u003e= V4.0 \u003c V4.0 SP1), SIPLUS TIM 1531 IRC (All versions \u003c V2.3.6), TIM 1531 IRC (All versions \u003c V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.","status":"published","published":"2022-02-09T15:16:57Z","modified":"2025-04-18T18:29:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T20:52:19.650141Z"}],"ghsa":[{"id":"GHSA-78f8-w6wx-97fh","title":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003c V2.9.4),...","description":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003c V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003e= V4.5.0 \u003c V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions), TIM 1531 IRC (incl. SIPLUS NET variants) (All versions \u003e= V2.2). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.","status":"published","published":"2022-02-10T00:00:29Z","modified":"2023-01-27T05:01:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:41:53.704212Z"}],"nvd":[{"id":"CVE-2021-37205","description":"A vulnerability has been identified in SIMATIC Drive Controller family (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions \u003e= V4.5.0 \u003c V4.5.2), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions \u003e= V2.9.2 \u003c V2.9.4), SIMATIC S7-1500 Software Controller (All versions \u003e= V21.9 \u003c V21.9.4), SIMATIC S7-PLCSIM Advanced (All versions \u003e= V4.0 \u003c V4.0 SP1), SIPLUS TIM 1531 IRC (All versions \u003c V2.3.6), TIM 1531 IRC (All versions \u003c V2.3.6). An unauthenticated attacker could cause a denial-of-service condition in a PLC when sending specially prepared packets over port 102/tcp. A restart of the affected device is needed to restore normal operations.","status":"published","published":"2022-02-09T16:15:13.393Z","modified":"2026-06-17T04:00:15.873Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.1,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:07:04.178977Z"}]}}