Siemens SIMATIC S7-1200 Web Server Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Siemens SIMATIC S7-1200 CPU V1 and V2 families, including SIPLUS variants, all versions prior to V2.0.3. The issue arises because the web server interface improperly handles incoming malformed HTTP traffic at a high rate. This flaw could enable an unauthenticated remote attacker to force the device into a stop or defect state, creating a denial-of-service condition.

Impact

Exploitation of this vulnerability causes the device to enter a stop or defect state, disrupting normal operations and communication.

Remediation

Siemens recommends updating to the latest version. If an update is not possible, the web server can be disabled, if feasible.