CVE-2021-40365

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
SiemensSIMATIC Drive Controller CPU 1504D TFAll versions < V2.9.7
SiemensSIMATIC Drive Controller CPU 1507D TFAll versions < V2.9.7
SiemensSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)All versions < V21.9.7
SiemensSIMATIC S7-1200 CPU family (incl. SIPLUS variants)All versions < V4.6.0
SiemensSIMATIC S7-1500 CPU 1510SP F-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1510SP-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511C-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511C-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511F-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511F-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511T-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1511TF-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1512C-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1512C-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1512SP F-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1512SP-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1513-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1513-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1513F-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1513F-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1513R-1 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515F-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515F-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515R-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515T-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1515TF-2 PNAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1516-3 PN/DPAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1516-3 PN/DPAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1516F-3 PN/DPAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1516F-3 PN/DPAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU 1516T-3 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1516TF-3 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1517-3 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1517F-3 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1517H-3 PNAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1517T-3 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1517TF-3 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518HF-4 PNAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518T-4 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU 1518TF-4 PN/DPAll versions < V3.0.1
SiemensSIMATIC S7-1500 CPU S7-1518-4 PN/DP ODKAll versions < V2.9.7
SiemensSIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODKAll versions < V2.9.7

References

Timeline

Published
Dec 13, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-403667.4A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V1CVE-2021-403677.8A vulnerability has been identified in syngo fastView (All versions). The affected application lacks proper validation of user-supplied dataCVE-2021-403687.5A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (All versions), SIMACVE-2021-403696.1A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which couldCVE-2021-40374.4A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files foCVE-2021-403719.8Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by .CVE-2021-403739.8playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then executCVE-2021-403745.4A stored cross-site scripting (XSS) vulnerability was identified in Apperta Foundation OpenEyes 3.5.1. Updating a patient's details allows rCVE-2021-403756.5Apperta Foundation OpenEyes 3.5.1 allows remote attackers to view the sensitive information of patients without having the intended level ofCVE-2021-403767.8otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pCVE-2021-403775.4SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to injectCVE-2021-403788.1An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all da
CVE-2021-40365: High severity, CVSS 7.5 | Vulnix