← Vulnerability feed

Vulnerability record · CVE-2018-13815 · published 13 December 2018

CVE-2018-13815: Siemens simatic s7-1200 firmware uncontrolled resource consumption vulnerability

Siemens · Simatic S7 1200 Firmware

A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacker could exhaust the available connection pool of an affected device by opening a sufficient number of connections to the device. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. The vulnerability, if exploited, could cause a Denial-of-Service condition impacting the availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known.

7.5 CVSS 3.0 High EPSS 1.8% · top 22.4% CWE-410 · CWE-410CWE-400 · Uncontrolled resource consumption
7.5CVSS 3.0 base score, v2 5.0
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacker could exhaust the available connection pool of an affected device by opening a sufficient number of connections to the device. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. The vulnerability, if exploited, could cause a Denial-of-Service condition impacting the availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/105928 Third Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-584286.pdf Vendor Advisory
http://www.securityfocus.com/bid/105928 Third Party AdvisoryVDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-584286.pdf Vendor Advisory

Track CVE-2018-13815 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2014-0160OpenSSL TLS/DTLS Heartbeat Extension Out-of-Bounds Read (Heartbleed)OpenSSL 1.0.1 before 1.0.1g mishandles Heartbeat Extension packets in its TLS and DTLS implementations, causing an out-of-bounds read of process memo…KEVEPSS 100%analysed8.7CVE-2020-28400Siemens dk standard ethernet controller evaluation kit firmware allocation without limits vulnerabilityAffected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be t…EPSS 1.9%8.7CVE-2017-12741Siemens simatic s7-200 firmware uncontrolled resource consumption vulnerabilitySpecially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually.EPSS 3.3%7.8CVE-2020-8744Intel converged security and management engine vulnerabilityImproper initialization in subsystem for Intel(R) CSME versions before12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 4…EPSS 0.36%7.8CVE-2013-0700Siemens simatic s7-1200 firmware vulnerabilitySiemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted …EPSS 2.4%7.8CVE-2013-2780Siemens simatic s7-1200 firmware vulnerabilitySiemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted …EPSS 2.4%7.5CVE-2018-16558Siemens simatic s7-1500 firmware improper input validation vulnerabilityA vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially…EPSS 2.0%7.5CVE-2018-16559Siemens simatic s7-1500 firmware improper input validation vulnerabilityA vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2018-13815), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.