CVE-2017-2680

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
SiemensDevelopment/Evaluation Kits for PROFINET IO: DK Standard Ethernet ControllerAll versions < V4.1.1 Patch04
SiemensDevelopment/Evaluation Kits for PROFINET IO: EK-ERTEC 200All versions < V4.2.1 Patch03
SiemensDevelopment/Evaluation Kits for PROFINET IO: EK-ERTEC 200PAll versions < V4.4.0 Patch01
SiemensExtension Unit 12" PROFINETAll versions < V01.01.01
SiemensExtension Unit 15" PROFINETAll versions < V01.01.01
SiemensExtension Unit 19" PROFINETAll versions < V01.01.01
SiemensExtension Unit 22" PROFINETAll versions < V01.01.01
SiemensIE/AS-i Link PN IOAll versions
SiemensIE/PB-Link (incl. SIPLUS NET variants)All versions < V3.0
SiemensSCALANCE M-800 family (incl. S615, MUM-800 and RM1224)All versions < V4.03
SiemensSCALANCE W-700 IEEE 802.11n familyAll versions < V6.1
SiemensSCALANCE X-200 family (incl. SIPLUS NET variants)All versions < V5.2.2
SiemensSCALANCE X-200IRT family (incl. SIPLUS NET variants)All versions < V5.4.0
SiemensSCALANCE X-300 family (incl. X408 and SIPLUS NET variants)All versions < V4.1.0
SiemensSCALANCE X408 familyAll versions < V4.1.0
SiemensSCALANCE X414All versions < V3.10.2
SiemensSCALANCE XM-400 familyAll versions < V6.1
SiemensSCALANCE XR-500 familyAll versions < V6.1
SiemensSIMATIC CM 1542-1All versions < V2.0
SiemensSIMATIC CM 1542SP-1All versions < V1.0.15
SiemensSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)All versions < V2.1.82
SiemensSIMATIC CP 1243-1 (incl. SIPLUS variants)All versions < V2.1.82
SiemensSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)< *
SiemensSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)All versions
SiemensSIMATIC CP 1243-7 LTE USAll versions < V2.1.82
SiemensSIMATIC CP 1243-8 IRCAll versions < V2.1.82
SiemensSIMATIC CP 1243-8 IRCAll versions < V2.1.82
SiemensSIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants)All versions < V1.0.15
SiemensSIMATIC CP 1543-1 (incl. SIPLUS variants)All versions < V2.1
SiemensSIMATIC CP 1543SP-1 (incl. SIPLUS variants)All versions < V1.0.15
SiemensSIMATIC CP 1604All versions < V2.7
SiemensSIMATIC CP 1616All versions < V2.7
SiemensSIMATIC CP 1626All versions < V1.1
SiemensSIMATIC CP 343-1 (incl. SIPLUS variants)All versions < V3.1.3
SiemensSIMATIC CP 343-1 Advanced (incl. SIPLUS variants)All versions
SiemensSIMATIC CP 343-1 Lean (incl. SIPLUS variants)All versions < V3.1.3
SiemensSIMATIC CP 443-1 (incl. SIPLUS variants)All versions < V3.2.17
SiemensSIMATIC CP 443-1 Advanced (incl. SIPLUS variants)All versions < V3.2.17
SiemensSIMATIC CP 443-1 OPC UAAll versions
SiemensSIMATIC DK-16xx PN IOAll versions < V2.7
SiemensSIMATIC ET 200AL IM 157-1 PN< V1.0.2
SiemensSIMATIC ET 200M (incl. SIPLUS variants)All versions
SiemensSIMATIC ET 200MP IM 155-5 PN BA< V4.0.1
SiemensSIMATIC ET 200MP IM 155-5 PN HF< V4.2.0
SiemensSIMATIC ET 200MP IM 155-5 PN ST< V4.1.0
SiemensSIMATIC ET 200pro IM 154-3 PN HF< *
SiemensSIMATIC ET 200pro IM 154-4 PN HF< *
SiemensSIMATIC ET 200SP IM 155-6 PN BA< *
SiemensSIMATIC ET 200SP IM 155-6 PN HF< V4.2.0
SiemensSIMATIC ET 200SP IM 155-6 PN HS< V4.0.1

References

Timeline

Published
May 11, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-26816.5Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service conCVE-2017-26828.8The Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site RequestCVE-2017-26838.2A non-privileged user of the Siemens web application RUGGEDCOM NMS < V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-SitCVE-2017-26849.0Siemens SIMATIC Logon prior to V1.5 SP3 Update 2 could allow an attacker with knowledge of a valid user name, and physical or network accessCVE-2017-26857.4Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and CVE-2017-26866.5Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability that could allow an authenticated user to read arbitrary files through the weCVE-2017-26876.1Siemens RUGGEDCOM ROX I (all versions) contain a vulnerability in the integrated web server at port 10000/TCP which is prone to reflected CrCVE-2017-26888.8The integrated web server in Siemens RUGGEDCOM ROX I (all versions) at port 10000/TCP could allow remote attackers to perform actions with tCVE-2017-26898.8Siemens RUGGEDCOM ROX I (all versions) allow an authenticated user to bypass access restrictions in the web interface at port 10000/TCP to oCVE-2017-26905.5SoftCo with software V200R003C20,eSpace U1910 with software V200R003C00, V200R003C20 and V200R003C30,eSpace U1911 with software V200R003C20,CVE-2017-26916.8Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versionCVE-2017-26927.8The Keyguard application in ALE-L02C635B140 and earlier versions,ALE-L02C636B140 and earlier versions,ALE-L21C10B150 and earlier versions,AL
CVE-2017-2680: Medium severity, CVSS 6.5 | Vulnix