Siemens SCALANCE LPE9403 Profinet Packet Validation Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Siemens SCALANCE LPE9403 devices (6GK5998-3GS00-2AC2, all versions). The issue arises because affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet, causing the dcpd process to crash.

Impact

Exploitation of this vulnerability leads to a crash of the dcpd process, causing a denial-of-service condition on the affected device.

Remediation

Siemens recommends disabling the Profinet Discovery and Configuration Protocol (DCP) service on affected devices. For general security, it is advised to protect network access to devices with appropriate measures and to follow Siemens' operational guidelines for Industrial Security.