CVE-2017-2680 describes a denial-of-service vulnerability affecting Siemens products, specifically those utilizing PROFINET DCP on a local Ethernet segment. An unauthenticated attacker can exploit this by sending specially crafted PROFINET DCP broadcast packets, leading to a denial of service that requires manual intervention to recover. With a CVSS score of 6.5 (Medium), the attack requires local network access but no user interaction, impacting availability. While the vulnerability has garnered some community discussion and media coverage, there is no evidence of active exploitation, nor are public exploit codes like Metasploit or ExploitDB entries available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.1.3CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_cp_343-1_std_firmware:*:*:*:*:*:*:*:* | ||
< 3.1.3CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_cp_343-1_lean_firmware:*:*:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:siemens:simatic_cp_343-1_adv_firmware:*:*:*:*:*:*:*:* | ||
< 3.2.17CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_cp_443-1_std_firmware:*:*:*:*:*:*:*:* | ||
< 3.2.17CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_cp_443-1_adv_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.