CVE-2023-36521

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-36521
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4), SIMATIC MV550 H (All versions < V3.3.4), SIMATIC MV550 S (All versions < V3.3.4), SIMATIC MV560 U (All versions < V3.3.4), SIMATIC MV560 X (All versions < V3.3.4). The result synchronization server of the affected products contains a vulnerability that may lead to a denial of service condition. An attacker may cause a denial of service situation of all socket-based communication of the affected products if the result server is enabled.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:siemens:simatic_mv540_h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv540_h:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:siemens:simatic_mv540_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv540_s:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:siemens:simatic_mv550_h_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv550_h:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:siemens:simatic_mv550_s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv550_s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:siemens:simatic_mv560_u_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv560_u:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:simatic_mv560_x_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:simatic_mv560_x:-:*:*:*:*:*:*:*
History

23 Oct 2026, 23:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad ha sido identificada en SIMATIC MV540 H (Todas las versiones anteriores a V3.3.4), SIMATIC MV540 S (Todas las versiones anteriores a V3.3.4), SIMATIC MV550 H (Todas las versiones anteriores a V3.3.4), SIMATIC MV550 S (Todas las versiones anteriores a V3.3.4), SIMATIC MV560 U (Todas las versiones anteriores a V3.3.4), SIMATIC MV560 X (Todas las versiones anteriores a V3.3.4). El servidor de sincronización de resultados de los productos afectados contiene una vulnerabilidad que puede conducir a una condición de denegación de servicio. Un atacante puede causar una situación de denegación de servicio de toda la comunicación basada en sockets de los productos afectados si el servidor de resultados está habilitado.
Information

Published : 2023-07-11 10:15

Updated : 2026-10-23 23:10

NVD link : CVE-2023-36521

Mitre link : CVE-2023-36521

CVE.ORG link : CVE-2023-36521

JSON object : View

Products Affected

siemens

  • simatic_mv560_x_firmware
  • simatic_mv560_x
  • simatic_mv550_h
  • simatic_mv550_s
  • simatic_mv560_u
  • simatic_mv540_s_firmware
  • simatic_mv540_s
  • simatic_mv540_h
  • simatic_mv550_h_firmware
  • simatic_mv550_s_firmware
  • simatic_mv540_h_firmware
  • simatic_mv560_u_firmware
CWE
CWE-770

Allocation of Resources Without Limits or Throttling