CVE-2025-40944A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2.0), SIMATIC ET 200S…
Updated under an hour ago ()
Does this affect you?
It affects Siemens SIMATIC ET 200AL IM 157-1 PN and 14 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (All versions), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (All versions < V1.3), SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) (All versions < V6.0.1), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (All versions >= V4.2.0 < V4.2.5), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (All versions < V4.2.2), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (All versions), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (All versions < V6.0.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (All versions >= V4.2.0 < V4.2.5), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (All versions < V6.0.0). Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, the devices enter an improper session state. This could allow an attacker to cause the device to become unresponsive, leading to a denial-of-service condition that requires a power cycle to restore normal operation.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-400
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- siemens
- NVD analysis
- Deferred
- Record last updated
- Jun 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Siemens SIMATIC ET 200AL IM 157-1 PN siemens:simatic_et_200al_im_157_1_pn (from the name) | all versions | CNA record |
Siemens SIMATIC ET 200MP IM 155-5 PN HF siemens:simatic_et_200mp_im_155_5_pn_hf (from the name) | from V4.2.0 | CNA record |
Siemens SIMATIC ET 200SP IM 155-6 MF HF siemens:simatic_et_200sp_im_155_6_mf_hf (from the name) | all versions | CNA record |
Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) siemens:simatic_et_200sp_im_155_6_pn_ha_incl_siplus_variants (from the name) | before V1.3 | CNA record |
Siemens SIMATIC ET 200SP IM 155-6 PN R1 siemens:simatic_et_200sp_im_155_6_pn_r1 (from the name) | before V6.0.1 | CNA record |
Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF siemens:simatic_et_200sp_im_155_6_pn_2_hf (from the name) | from V4.2.0 before V4.2.5 | CNA record |
Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF siemens:simatic_et_200sp_im_155_6_pn_3_hf (from the name) | before V4.2.2 | CNA record |
Siemens SIMATIC PN/MF Coupler siemens:simatic_pn_mf_coupler (from the name) | all versions | CNA record |
Siemens SIMATIC PN/PN Coupler siemens:simatic_pn_pn_coupler (from the name) | before V6.0.0 | CNA record |
Siemens SIPLUS ET 200MP IM 155-5 PN HF siemens:siplus_et_200mp_im_155_5_pn_hf (from the name) | from V4.2.0 | CNA record |
Siemens SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL siemens:siplus_et_200mp_im_155_5_pn_hf_t1_rail (from the name) | from V4.2.0 | CNA record |
Siemens SIPLUS ET 200SP IM 155-6 PN HF siemens:siplus_et_200sp_im_155_6_pn_hf (from the name) | from V4.2.0 before V4.2.5 | CNA record |
Siemens SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL siemens:siplus_et_200sp_im_155_6_pn_hf_t1_rail (from the name) | from V4.2.0 before V4.2.5 | CNA record |
Siemens SIPLUS ET 200SP IM 155-6 PN HF TX RAIL siemens:siplus_et_200sp_im_155_6_pn_hf_tx_rail (from the name) | from V4.2.0 before V4.2.5 | CNA record |
Siemens SIPLUS NET PN/PN Coupler siemens:siplus_net_pn_pn_coupler (from the name) | before V6.0.0 | CNA record |
References
- https://cert-portal.siemens.com/productcert/html/ssa-674753.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.