CVE-2025-24812 – A denial-of-service vulnerability exists in mul... (How to Fix)

Q: How do I fix CVE-2025-24812?

1. Download firmware V4.7 or later from Siemens Industry Online Support. 2. Use TIA Portal software to upload new firmware to affected PLCs. 3. Restart PLCs after firmware update. 4. Verify firmware version is V4.7 or higher.

Q: What is the severity of CVE-2025-24812?

CVE-2025-24812 has a CVSS score of 6.5 (MEDIUM). A denial-of-service vulnerability exists in multiple SIMATIC S7-1200 PLC models where specially crafted packets sent to TCP port 102 can crash the device. This affects industrial control systems using Siemens SIMATIC S7-1200 CPUs with firmware versions below V4.7. An attacker could disrupt critical industrial operations by sending malicious packets to vulnerable devices.

📋 TL;DR

A denial-of-service vulnerability exists in multiple SIMATIC S7-1200 PLC models where specially crafted packets sent to TCP port 102 can crash the device. This affects industrial control systems using Siemens SIMATIC S7-1200 CPUs with firmware versions below V4.7. An attacker could disrupt critical industrial operations by sending malicious packets to vulnerable devices.

💻 Affected Systems

Products:

SIMATIC S7-1200 CPU 1211C AC/DC/Rly
SIMATIC S7-1200 CPU 1211C DC/DC/DC
SIMATIC S7-1200 CPU 1211C DC/DC/Rly
SIMATIC S7-1200 CPU 1212C AC/DC/Rly
SIMATIC S7-1200 CPU 1212C DC/DC/DC
SIMATIC S7-1200 CPU 1212C DC/DC/Rly
SIMATIC S7-1200 CPU 1212FC DC/DC/DC
SIMATIC S7-1200 CPU 1212FC DC/DC/Rly
SIMATIC S7-1200 CPU 1214C AC/DC/Rly
SIMATIC S7-1200 CPU 1214C DC/DC/DC
SIMATIC S7-1200 CPU 1214C DC/DC/Rly
SIMATIC S7-1200 CPU 1214FC DC/DC/DC
SIMATIC S7-1200 CPU 1214FC DC/DC/Rly
SIMATIC S7-1200 CPU 1215C AC/DC/Rly
SIMATIC S7-1200 CPU 1215C DC/DC/DC
SIMATIC S7-1200 CPU 1215C DC/DC/Rly
SIMATIC S7-1200 CPU 1215FC DC/DC/DC
SIMATIC S7-1200 CPU 1215FC DC/DC/Rly
SIMATIC S7-1200 CPU 1217C DC/DC/DC
SIPLUS S7-1200 CPU 1212 AC/DC/RLY
SIPLUS S7-1200 CPU 1212 DC/DC/RLY
SIPLUS S7-1200 CPU 1212C DC/DC/DC
SIPLUS S7-1200 CPU 1212C DC/DC/DC RAIL
SIPLUS S7-1200 CPU 1214 AC/DC/RLY
SIPLUS S7-1200 CPU 1214 DC/DC/DC
SIPLUS S7-1200 CPU 1214 DC/DC/RLY
SIPLUS S7-1200 CPU 1214C DC/DC/DC RAIL
SIPLUS S7-1200 CPU 1214FC DC/DC/DC
SIPLUS S7-1200 CPU 1214FC DC/DC/RLY
SIPLUS S7-1200 CPU 1215 AC/DC/RLY
SIPLUS S7-1200 CPU 1215 DC/DC/DC
SIPLUS S7-1200 CPU 1215 DC/DC/RLY
SIPLUS S7-1200 CPU 1215C DC/DC/DC
SIPLUS S7-1200 CPU 1215FC DC/DC/DC

Versions: All versions < V4.7

Operating Systems: PLC firmware

Default Config Vulnerable: ⚠️ Yes

Notes: All listed Siemens SIMATIC S7-1200 and SIPLUS S7-1200 CPU models with firmware below V4.7 are vulnerable when port 102/tcp is accessible.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device crash requiring physical restart, causing production downtime, safety system failures, or process disruptions in critical infrastructure.

🟠

Likely Case

Temporary denial of service requiring manual intervention to restart affected PLCs, disrupting automated processes.

🟢

If Mitigated

Minimal impact with proper network segmentation and access controls preventing unauthorized access to port 102.

🌐 Internet-Facing: HIGH - If devices are directly exposed to the internet, attackers can easily send crafted packets to cause denial of service.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this, but network segmentation reduces risk.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted packets to port 102/tcp, which is typically open for Siemens S7 communication. No authentication is required if network access is available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: V4.7 or later

Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-224824.html

Restart Required: Yes

Instructions:

1. Download firmware V4.7 or later from Siemens Industry Online Support. 2. Use TIA Portal software to upload new firmware to affected PLCs. 3. Restart PLCs after firmware update. 4. Verify firmware version is V4.7 or higher.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict access to port 102/tcp using firewalls to only trusted engineering stations and SCADA systems.

Access Control Lists

all

Implement network ACLs to block unauthorized IP addresses from accessing PLCs on port 102.

🧯 If You Can't Patch

Implement strict network segmentation to isolate PLCs from untrusted networks
Deploy intrusion detection systems to monitor for anomalous traffic on port 102

🔍 How to Verify

Check if Vulnerable:

Check firmware version in TIA Portal or via web interface. If version is below V4.7 and port 102/tcp is accessible, device is vulnerable.

Check Version:

Use TIA Portal: Online & Diagnostics > General > Firmware version

Verify Fix Applied:

Confirm firmware version is V4.7 or higher in device properties. Test connectivity to port 102/tcp to ensure legitimate communication still works.

📡 Detection & Monitoring

Log Indicators:

PLC restart events
Connection attempts to port 102 from unauthorized sources
Abnormal packet patterns on port 102

Network Indicators:

Unusual traffic volume to port 102/tcp
Crafted packets targeting port 102
Connection attempts from unexpected IP ranges

SIEM Query:

source_port:102 AND (packet_size:anomalous OR protocol_violation:true)

📊 Metadata

CVE ID: CVE-2025-24812

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-1286

EPSS Score: 0.09% exploit probability (26.4th percentile)

Published: February 11, 2025

Last Updated: February 11, 2025

🔗 References

https://cert-portal.siemens.com/productcert/html/ssa-224824.html

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-24812, you might also want to check these: