CVE-2023-38380

Description

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE (All versions < V3.4.29), SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.3), SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) (All versions < V2.3), SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) (All versions < V3.0.37), SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) (All versions < V2.3), SINAMICS S210 (6SL5...) (All versions >= V6.1 < V6.1 HF2), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) (All versions < V2.3), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) (All versions < V2.3), SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) (All versions < V3.0.37). The webserver implementation of the affected products does not correctly release allocated memory after it has been used. An attacker with network access could use this vulnerability to cause a denial-of-service condition in the webserver of the affected product.

Category

8.7
CVSS
Severity: High
CVSS 4.0 •
CVSS 3.1 •
EPSS 0.11%
Vendor Advisory siemens.com
Affected: Siemens SIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Affected: Siemens SIMATIC CP 1243-1 (incl. SIPLUS variants)
Affected: Siemens SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Affected: Siemens SIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Affected: Siemens SIMATIC CP 1243-7 LTE
Affected: Siemens SIMATIC CP 1243-8 IRC
Affected: Siemens SIMATIC CP 1542SP-1
Affected: Siemens SIMATIC CP 1542SP-1 IRC
Affected: Siemens SIMATIC CP 1543-1
Affected: Siemens SIMATIC CP 1543SP-1
Affected: Siemens SINAMICS S210 (6SL5...)
Affected: Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL
Affected: Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC
Affected: Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL
Affected: Siemens SIPLUS NET CP 1543-1
Published at:
Updated at:

References

Link Tags
https://cert-portal.siemens.com/productcert/pdf/ssa-693975.pdf vendor advisory
https://cert-portal.siemens.com/productcert/html/ssa-693975.html
https://cert-portal.siemens.com/productcert/html/ssa-139628.html
https://cert-portal.siemens.com/productcert/html/ssa-625862.html

Frequently Asked Questions

What is the severity of CVE-2023-38380?
CVE-2023-38380 has been scored as a high severity vulnerability.
How to fix CVE-2023-38380?
To fix CVE-2023-38380, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-38380 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-38380 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-38380?
CVE-2023-38380 affects Siemens SIMATIC CP 1242-7 V2 (incl. SIPLUS variants), Siemens SIMATIC CP 1243-1 (incl. SIPLUS variants), Siemens SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants), Siemens SIMATIC CP 1243-1 IEC (incl. SIPLUS variants), Siemens SIMATIC CP 1243-7 LTE, Siemens SIMATIC CP 1243-8 IRC, Siemens SIMATIC CP 1542SP-1, Siemens SIMATIC CP 1542SP-1 IRC, Siemens SIMATIC CP 1543-1, Siemens SIMATIC CP 1543SP-1, Siemens SINAMICS S210 (6SL5...), Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL, Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC, Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL, Siemens SIPLUS NET CP 1543-1.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.