CVE-2025-40944: Siemens SIMATIC DOS Vulnerability

CVE-2025-40944 Overview

A denial-of-service vulnerability has been identified in multiple Siemens SIMATIC ET 200 series industrial automation devices and related components. The vulnerability exists due to improper handling of S7 protocol session disconnect requests. When affected devices receive a valid S7 protocol Disconnect Request (COTP DR TPDU) on TCP port 102, they enter an improper session state that causes the device to become unresponsive.

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and can be exploited remotely without authentication, making it particularly dangerous in industrial control system (ICS) environments where device availability is critical to operational continuity.

Critical Impact

Successful exploitation causes affected Siemens industrial automation devices to become unresponsive, requiring a physical power cycle to restore normal operation. This can lead to significant operational disruptions in industrial environments.

Affected Products

• SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) - All versions
• SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) - All versions >= V4.2.0
• SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) - All versions
• SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) - All versions < V1.3
• SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0) - All versions < V6.0.1
• SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) - All versions >= V4.2.0
• SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) - All versions < V4.2.2
• SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) - All versions
• SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) - All versions < V6.0.0
• SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0) - All versions >= V4.2.0
• SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-7AC0) - All versions >= V4.2.0
• SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL (6AG2155-5AA00-1AC0) - All versions >= V4.2.0
• SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-2CN0) - All versions >= V4.2.0
• SIPLUS ET 200SP IM 155-6 PN HF (6AG1155-6AU01-7CN0) - All versions >= V4.2.0
• SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL (6AG2155-6AU01-1CN0) - All versions >= V4.2.0
• SIPLUS ET 200SP IM 155-6 PN HF TX RAIL (6AG2155-6AU01-4CN0) - All versions >= V4.2.0
• SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0) - All versions < V6.0.0

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-40944 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-40944

Vulnerability Analysis

The vulnerability resides in the S7 protocol implementation within affected Siemens SIMATIC devices. The S7 protocol is Siemens' proprietary communication protocol used extensively in industrial automation for PLC communication, and it operates over TCP port 102 using the ISO-on-TCP (RFC 1006) transport layer.

The core issue is that affected devices fail to properly manage session state when processing COTP (Connection-Oriented Transport Protocol) Disconnect Request TPDUs (Transport Protocol Data Units). When a valid DR (Disconnect Request) packet is received, the device enters an improper internal state from which it cannot recover without a power cycle.

This represents a classic resource exhaustion vulnerability where the session management logic fails to handle edge cases in the protocol state machine, leaving the device in an unrecoverable error state.

Root Cause

The root cause is improper session state management in the S7 protocol handler (CWE-400: Uncontrolled Resource Consumption). When the device processes a valid S7 protocol Disconnect Request on TCP port 102, the session state machine transitions to an invalid state. The implementation lacks proper error handling and recovery mechanisms, causing the device to become permanently unresponsive until power cycled.

This type of vulnerability is particularly concerning in ICS environments because:

• The attack requires only network access to TCP port 102
• No authentication is required to send the malicious disconnect request
• The impact is immediate and requires physical intervention to resolve
• Multiple devices in a production environment could be targeted simultaneously

Attack Vector

The attack can be executed remotely over the network by any attacker who can reach TCP port 102 on the affected device. The attack flow involves:

1. Establishing a TCP connection to the target device on port 102
2. Initiating a valid ISO-on-TCP (COTP) session
3. Sending a crafted COTP Disconnect Request (DR TPDU) packet
4. The target device enters an improper session state and becomes unresponsive

The attack does not require any special privileges or authentication, and the malicious traffic would appear as legitimate S7 protocol communication, making detection challenging without deep protocol inspection.

No authentication is needed, and the attack can be repeated against multiple devices to cause widespread operational disruption in industrial facilities.

Detection Methods for CVE-2025-40944

Indicators of Compromise

• Unexpected device unresponsiveness requiring power cycle to recover
• Anomalous COTP Disconnect Request (DR TPDU) packets targeting TCP port 102
• Multiple disconnect requests from unusual source IP addresses
• Device communication failures in SIMATIC ET 200 series modules without apparent cause

Detection Strategies

• Implement deep packet inspection (DPI) for S7 protocol traffic on TCP port 102
• Monitor for unusual patterns of COTP disconnect requests, especially from external or unexpected sources
• Deploy industrial protocol-aware intrusion detection systems (IDS) capable of parsing S7/ISO-on-TCP traffic
• Configure network monitoring to alert on repeated disconnect requests to multiple SIMATIC devices

Monitoring Recommendations

• Enable logging on network firewalls and industrial DMZ devices for all traffic to TCP port 102
• Implement baseline monitoring for S7 protocol communication patterns to detect anomalies
• Monitor device availability and response times for SIMATIC ET 200 series devices
• Configure alerts for any device requiring unexpected power cycles or exhibiting communication failures

How to Mitigate CVE-2025-40944

Immediate Actions Required

• Review network architecture to ensure SIMATIC devices are not directly accessible from untrusted networks
• Implement network segmentation to isolate industrial control system networks from corporate IT and internet-facing networks
• Apply firewall rules to restrict access to TCP port 102 to only authorized engineering workstations and HMI systems
• Consult the Siemens Security Advisory SSA-674753 for device-specific guidance

Patch Information

Siemens has released firmware updates for several affected products. Organizations should update to the following versions:

• SIMATIC ET 200SP IM 155-6 PN HA: Update to version V1.3 or later
• SIMATIC ET 200SP IM 155-6 PN R1: Update to version V6.0.1 or later
• SIMATIC ET 200SP IM 155-6 PN/3 HF: Update to version V4.2.2 or later
• SIMATIC PN/PN Coupler: Update to version V6.0.0 or later
• SIPLUS NET PN/PN Coupler: Update to version V6.0.0 or later

For products where no patch is currently available (SIMATIC ET 200AL IM 157-1 PN, SIMATIC ET 200SP IM 155-6 MF HF, SIMATIC PN/MF Coupler, and certain SIPLUS variants), organizations should implement compensating controls until patches are released. Refer to the Siemens Security Advisory SSA-674753 for the latest patch availability information.

Workarounds

• Implement strict network segmentation using industrial firewalls to isolate affected devices from untrusted networks
• Restrict network access to TCP port 102 using access control lists (ACLs) to only authorized systems
• Deploy VPN solutions for remote access to industrial networks instead of direct connectivity
• Consider implementing application-layer firewalls capable of inspecting and filtering S7 protocol traffic
• Maintain documented recovery procedures for rapid device power cycling in case of exploitation