CVE-2024-35292: Siemens SIMATIC S7-200 SMART DoS Flaw

CVE-2024-35292 Overview

CVE-2024-35292 affects Siemens SIMATIC S7-200 SMART CPU product lines, including the CR40, CR60, SR20, SR30, SR40, SR60, ST20, ST30, ST40, and ST60 series across all firmware versions. The affected programmable logic controllers (PLCs) generate predictable IP identification (IP ID) sequence numbers in their network stack. An unauthenticated remote attacker on the network can leverage this weakness as the foundation for attacks that culminate in a denial of service condition against the affected industrial control devices. The flaw is tracked under CWE-330: Use of Insufficiently Random Values.

Critical Impact
Network-adjacent attackers can predict IP ID sequence numbers on SIMATIC S7-200 SMART PLCs, enabling spoofing, off-path injection, and denial of service against operational technology assets.

Affected Products

SIMATIC S7-200 SMART CPU CR40 (6ES7288-1CR40-0AA0) and CR60 (6ES7288-1CR60-0AA0), all versions
SIMATIC S7-200 SMART CPU SR20, SR30, SR40, SR60 (6ES7288-1SR**-0AA0/0AA1), all versions
SIMATIC S7-200 SMART CPU ST20, ST30, ST40, ST60 (6ES7288-1ST**-0AA0/0AA1), all versions

Discovery Timeline

2024-06-11 - CVE-2024-35292 published to NVD with Siemens advisory SSA-481506
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-35292

Vulnerability Analysis

The affected SIMATIC S7-200 SMART CPUs generate IP identification (IP ID) field values using a predictable sequence rather than a cryptographically random source. The IP ID is a 16-bit field in the IPv4 header used primarily to support fragmentation and reassembly of datagrams. When this value is predictable, attackers gain a side channel into the device's network behavior. An attacker on the same network segment, or one able to route traffic to the PLC, can enumerate IP IDs and infer device state, traffic load, and the identities of communicating peers.

The weakness enables a recognized family of off-path TCP attacks. By predicting the next IP ID an attacker can inject crafted packets that the target accepts as legitimate, forcibly close active control sessions, or saturate fragmentation reassembly resources. Sustained exploitation results in a denial of service condition on the PLC, which in industrial environments can disrupt physical process control and supervisory communications.

Root Cause

The root cause is the use of a deterministic counter for IP ID assignment in the device's TCP/IP stack instead of a per-flow randomized or cryptographically generated value. This pattern is classified under CWE-330: Use of Insufficiently Random Values.

Attack Vector

Exploitation requires only network reachability to the affected PLC. No authentication or user interaction is needed. The attacker observes IP ID values returned by the device, extrapolates the sequence, and then issues spoofed or fragmented traffic designed to disrupt sessions or exhaust reassembly buffers. The vulnerability mechanism is documented in the Siemens Security Advisory SSA-481506.

Detection Methods for CVE-2024-35292

Indicators of Compromise

Sequential or trivially predictable IP ID values observed in IPv4 headers of traffic originating from S7-200 SMART CPUs.
Unexpected TCP RST or connection drops on engineering and HMI sessions to affected PLCs.
Spikes in fragmented IPv4 traffic addressed to PLC management interfaces.
Unsolicited ICMP or TCP probes from external hosts targeting port 102 (ISO-TSAP) or port 502 (Modbus) on PLC subnets.

Detection Strategies

Capture and analyze PCAP samples from PLC VLANs and verify the entropy of the IP ID field across sessions.
Correlate engineering software disconnections with concurrent network anomalies using a centralized data lake.
Apply Snort or Suricata rules that flag high volumes of fragmented IPv4 traffic toward industrial CPE subnets.

Monitoring Recommendations

Enable continuous traffic baselining at the OT/IT boundary and alert on deviation from steady-state PLC communication patterns.
Log all source addresses initiating TCP connections to S7-200 SMART CPUs and review for non-engineering workstation origins.
Forward firewall and switch telemetry from process networks into a SIEM with retention sufficient for forensic review.

How to Mitigate CVE-2024-35292

Immediate Actions Required

Restrict network access to affected SIMATIC S7-200 SMART CPUs to engineering workstations and HMIs only, enforced at Layer 3 firewalls.
Place affected PLCs behind a dedicated OT firewall and deny traffic from corporate or untrusted networks.
Disable any unused services and ports on the PLCs and surrounding network infrastructure.
Monitor the Siemens ProductCERT advisory SSA-481506 for firmware updates and apply them when available.

Patch Information

Siemens documents the affected product list and mitigation guidance in SSA-481506. At the time of publication, the advisory lists all firmware versions of the enumerated S7-200 SMART CPUs as affected. Operators should consult the advisory directly for the current fix status and any released firmware revisions.

Workarounds

Segment the control network according to IEC 62443 zones and conduits to prevent untrusted hosts from reaching PLCs.
Deploy a VPN or IPsec tunnel for all remote engineering access and prohibit direct internet exposure of PLC interfaces.
Enforce strict allowlists on industrial firewalls so only authorized HMI and engineering IP addresses can initiate sessions to affected CPUs.
Use deep packet inspection capable of identifying S7 protocol anomalies and fragmented traffic patterns associated with off-path attacks.

bash

# Example iptables allowlist on an OT gateway protecting S7-200 SMART CPUs
# Replace 10.10.20.0/24 with the engineering workstation subnet
# Replace 10.20.30.10 with the PLC IP address

iptables -A FORWARD -s 10.10.20.0/24 -d 10.20.30.10 -p tcp --dport 102 -j ACCEPT
iptables -A FORWARD -d 10.20.30.10 -j DROP
iptables -A FORWARD -s 10.20.30.10 -m state --state ESTABLISHED,RELATED -j ACCEPT