Skip to content
Fencer Vulns
high 7.4

CVE-2020-25705 json

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports.

published 2020-11-17 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-18360

cvss
7.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.7%
EPSS 6.7% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an off-path remote attacker to effectively bypass source port UDP randomization. Software that relies on UDP source port randomization are indirectly affected as well on the Linux Based Products (RUGGEDCOM RM1224: All versions between v5.0 and v6.4, SCALANCE M-800: All versions between v5.0 and v6.4, SCALANCE S615: All versions between v5.0 and v6.4, SCALANCE SC-600: All versions prior to v2.1.3, SCALANCE W1750D: v8.3.0.1, v8.6.0, and v8.7.0, SIMATIC Cloud Connect 7: All versions, SIMATIC MV500 Family: All versions, SIMATIC NET CP 1243-1 (incl. SIPLUS variants): Versions 3.1.39 and later, SIMATIC NET CP 1243-7 LTE EU: Version

Patch / fix

  • linux linux_kernel 5.10.0
  • linux Debian 14, Debian 13, Debian 12 5.9.6-1

debian advisories DEBIAN-CVE-2020-25705

  • linux Ubuntu 16.04 LTS 4.4.0-197.229
  • linux Ubuntu 18.04 LTS 4.15.0-129.132
  • linux Ubuntu 20.04 LTS 5.4.0-56.62
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1118.132
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1091.96
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1030.31
  • linux-gcp Ubuntu 16.04 LTS 4.15.0-1091.104~16.04.1
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1030.32

ubuntu advisories UBUNTU-CVE-2020-25705

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 7 3.10.0-1160.21.1.el7
  • perf RHEL 7 3.10.0-1160.21.1.el7
  • bpftool RHEL 7 3.10.0-1160.21.1.el7
  • python-perf RHEL 7 3.10.0-1160.21.1.el7
  • kernel-kdump RHEL 7 3.10.0-1160.21.1.el7
  • kernel-tools RHEL 7 3.10.0-1160.21.1.el7
  • kernel-tools-libs RHEL 7 3.10.0-1160.21.1.el7
  • kernel-bootwrapper RHEL 7 3.10.0-1160.21.1.el7

red hat advisories RHSA-2021:0765RHSA-2021:0774RHSA-2021:0686RHSA-2021:0856RHSA-2021:0857RHSA-2021:2164

  • kernel-rt Real Time Module 15 SP2 5.3.18-19.1
  • kernel-syms-rt Real Time Module 15 SP2 5.3.18-19.1
  • kernel-rt_debug Real Time Module 15 SP2 5.3.18-19.1
  • kernel-source-rt Real Time Module 15 SP2 5.3.18-19.1
  • kernel-syms SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-122.54.1
  • kernel-source SLES for SAP 12 SP5, SLES 12 SP5 4.12.14-122.54.1
  • kernel-default SLES for SAP 12 SP5, SLES 12 SP5, SLE Workstation Extension 12 SP5 +2 more 4.12.14-122.54.1
  • kernel-obs-build SLE Software Development Kit 12 SP5 4.12.14-122.54.1

suse advisories SUSE-SU-2020:3764-1SUSE-SU-2020:3717-1SUSE-SU-2020:3690-1SUSE-SU-2020:3670-1SUSE-SU-2020:3651-1SUSE-SU-2020:3544-1

  • sca-patterns-sle12 openSUSE Tumbleweed 1.0.8-2.2
  • sca-patterns-sle15 openSUSE Tumbleweed 1.0.8-2.2
  • kernel-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
  • kernel-syms-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
  • kernel-rt_debug openSUSE Leap 15.2 5.3.18-lp152.3.5.1
  • kernel-source-rt openSUSE Leap 15.2 5.3.18-lp152.3.5.1
  • kernel-syms openSUSE Leap 15.2 5.3.18-lp152.54.1
  • kernel-obs-qa openSUSE Leap 15.2 5.3.18-lp152.54.1

opensuse advisories openSUSE-SU-2024:11370-1openSUSE-SU-2024:11371-1openSUSE-SU-2021:0242-1openSUSE-SU-2020:2161-1openSUSE-SU-2020:2112-1openSUSE-SU-2020:2034-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-25705 updated cvss 7.4

kernel: ICMP rate limiting can be used for DNS poisoning attack

  • Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 perf, kernel, kernel-alt, python-perf, kernel-kdump, kernel-tools, +3 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise MRG 2 kernel-rt, mrg-rt-release, kernel-rt-trace, kernel-rt-vanilla, kernel-rt-firmware
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder (v. 8) kernel-debuginfo-common-x86_64 4.18.0-240.15.1.el8_3, kernel-debuginfo-common-aarch64 4.18.0-240.15.1.el8_3, kernel-debuginfo-common-ppc64le 4.18.0-240.15.1.el8_3
    fixed: vendor fix RHSA-2021:0558
  • Red Hat CodeReady Linux Builder EUS (v. 8.1) kernel-debuginfo-common-x86_64 4.18.0-147.43.1.el8_1, kernel-debuginfo-common-aarch64 4.18.0-147.43.1.el8_1, kernel-debuginfo-common-ppc64le 4.18.0-147.43.1.el8_1
    fixed: vendor fix RHSA-2021:0686
  • Red Hat CodeReady Linux Builder EUS (v. 8.2) kernel-debuginfo-common-x86_64 4.18.0-193.46.1.el8_2, kernel-debuginfo-common-aarch64 4.18.0-193.46.1.el8_2, kernel-debuginfo-common-ppc64le 4.18.0-193.46.1.el8_2
    fixed: vendor fix RHSA-2021:0765
  • Red Hat Enterprise Linux BaseOS (v. 8) perf 4.18.0-240.15.1.el8_3, kernel 4.18.0-240.15.1.el8_3, bpftool 4.18.0-240.15.1.el8_3, kernel-core 4.18.0-240.15.1.el8_3, kernel-tools 4.18.0-240.15.1.el8_3, python3-perf 4.18.0-240.15.1.el8_3, +15 more
    fixed: vendor fix RHSA-2021:0558
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) kernel 4.18.0-147.43.1.el8_1, kernel-core 4.18.0-147.43.1.el8_1, kernel-modules 4.18.0-147.43.1.el8_1, kernel-zfcpdump 4.18.0-147.43.1.el8_1, kernel-debug-core 4.18.0-147.43.1.el8_1, kernel-debug-modules 4.18.0-147.43.1.el8_1, +9 more
    fixed: vendor fix RHSA-2021:0686
show 28 more
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) perf 4.18.0-193.46.1.el8_2, kernel 4.18.0-193.46.1.el8_2, bpftool 4.18.0-193.46.1.el8_2, kernel-core 4.18.0-193.46.1.el8_2, kernel-tools 4.18.0-193.46.1.el8_2, python3-perf 4.18.0-193.46.1.el8_2, +15 more
    fixed: vendor fix RHSA-2021:0765
  • Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-1160.21.1.el7, kernel 3.10.0-1160.21.1.el7, bpftool 3.10.0-1160.21.1.el7, python-perf 3.10.0-1160.21.1.el7, kernel-tools 3.10.0-1160.21.1.el7, kernel-tools-libs 3.10.0-1160.21.1.el7, +2 more Red Hat Enterprise Linux Client Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.21.1.el7
    fixed: vendor fix RHSA-2021:0856
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) perf 3.10.0-1062.49.1.el7, kernel 3.10.0-1062.49.1.el7, bpftool 3.10.0-1062.49.1.el7, python-perf 3.10.0-1062.49.1.el7, kernel-tools 3.10.0-1062.49.1.el7, kernel-tools-libs 3.10.0-1062.49.1.el7, +2 more
    fixed: vendor fix RHSA-2021:1531
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.21.1.el7
    fixed: vendor fix RHSA-2021:0856
  • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) kernel-debuginfo-common-x86_64 3.10.0-1062.49.1.el7
    fixed: vendor fix RHSA-2021:1531
  • Red Hat Enterprise Linux for Real Time (v. 7) kernel-rt 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-trace 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.21.1.rt56.1158.el7 Red Hat Enterprise Linux for Real Time for NFV (v. 7) kernel-rt 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-kvm 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-trace 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-debug-kvm 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-trace-kvm 3.10.0-1160.21.1.rt56.1158.el7, kernel-rt-debuginfo-common-x86_64 3.10.0-1160.21.1.rt56.1158.el7
    fixed: vendor fix RHSA-2021:0857
  • Red Hat Enterprise Linux Real Time (v. 8) kernel-rt 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-core 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-modules 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-debug-core 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-debug-modules 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-modules-extra 4.18.0-240.15.1.rt7.69.el8_3, +2 more
    fixed: vendor fix RHSA-2021:0537
  • Red Hat Enterprise Linux Real Time EUS (v. 8.2) kernel-rt 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-core 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-modules 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-debug-core 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-debug-modules 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-modules-extra 4.18.0-193.46.1.rt13.96.el8_2, +2 more
    fixed: vendor fix RHSA-2021:0774
  • Red Hat Enterprise Linux Real Time for NFV (v. 8) kernel-rt 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-kvm 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-core 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-modules 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-debug-kvm 4.18.0-240.15.1.rt7.69.el8_3, kernel-rt-debug-core 4.18.0-240.15.1.rt7.69.el8_3, +4 more
    fixed: vendor fix RHSA-2021:0537
  • Red Hat Enterprise Linux Real Time for NFV EUS (v. 8.2) kernel-rt 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-kvm 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-core 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-modules 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-debug-kvm 4.18.0-193.46.1.rt13.96.el8_2, kernel-rt-debug-core 4.18.0-193.46.1.rt13.96.el8_2, +4 more
    fixed: vendor fix RHSA-2021:0774
  • Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-1160.21.1.el7, kernel 3.10.0-1160.21.1.el7, bpftool 3.10.0-1160.21.1.el7, python-perf 3.10.0-1160.21.1.el7, kernel-kdump 3.10.0-1160.21.1.el7, kernel-tools 3.10.0-1160.21.1.el7, +7 more
    fixed: vendor fix RHSA-2021:0856
  • Red Hat Enterprise Linux Server AUS (v. 7.4) perf 3.10.0-693.87.1.el7, kernel 3.10.0-693.87.1.el7, python-perf 3.10.0-693.87.1.el7, kernel-tools 3.10.0-693.87.1.el7, kernel-tools-libs 3.10.0-693.87.1.el7, kernel-abi-whitelists 3.10.0-693.87.1.el7, +1 more
    fixed: vendor fix RHSA-2021:2164
  • Red Hat Enterprise Linux Server AUS (v. 7.6) perf 3.10.0-957.76.1.el7, kernel 3.10.0-957.76.1.el7, bpftool 3.10.0-957.76.1.el7, python-perf 3.10.0-957.76.1.el7, kernel-tools 3.10.0-957.76.1.el7, kernel-tools-libs 3.10.0-957.76.1.el7, +2 more
    fixed: vendor fix RHSA-2021:2355
  • Red Hat Enterprise Linux Server E4S (v. 7.4) perf 3.10.0-693.87.1.el7, kernel 3.10.0-693.87.1.el7, python-perf 3.10.0-693.87.1.el7, kernel-tools 3.10.0-693.87.1.el7, kernel-tools-libs 3.10.0-693.87.1.el7, kernel-bootwrapper 3.10.0-693.87.1.el7, +3 more
    fixed: vendor fix RHSA-2021:2164
  • Red Hat Enterprise Linux Server E4S (v. 7.6) perf 3.10.0-957.76.1.el7, kernel 3.10.0-957.76.1.el7, bpftool 3.10.0-957.76.1.el7, python-perf 3.10.0-957.76.1.el7, kernel-tools 3.10.0-957.76.1.el7, kernel-tools-libs 3.10.0-957.76.1.el7, +4 more
    fixed: vendor fix RHSA-2021:2355
  • Red Hat Enterprise Linux Server EUS (v. 7.7) perf 3.10.0-1062.49.1.el7, kernel 3.10.0-1062.49.1.el7, bpftool 3.10.0-1062.49.1.el7, python-perf 3.10.0-1062.49.1.el7, kernel-kdump 3.10.0-1062.49.1.el7, kernel-tools 3.10.0-1062.49.1.el7, +7 more
    fixed: vendor fix RHSA-2021:1531
  • Red Hat Enterprise Linux Server Optional (v. 7) kernel-debuginfo-common-ppc64 3.10.0-1160.21.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1160.21.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1160.21.1.el7
    fixed: vendor fix RHSA-2021:0856
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.87.1.el7
    fixed: vendor fix RHSA-2021:2164
  • Red Hat Enterprise Linux Server Optional AUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.76.1.el7
    fixed: vendor fix RHSA-2021:2355
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.87.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-693.87.1.el7
    fixed: vendor fix RHSA-2021:2164
  • Red Hat Enterprise Linux Server Optional E4S (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.76.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-957.76.1.el7
    fixed: vendor fix RHSA-2021:2355
  • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) kernel-debuginfo-common-ppc64 3.10.0-1062.49.1.el7, kernel-debuginfo-common-x86_64 3.10.0-1062.49.1.el7, kernel-debuginfo-common-ppc64le 3.10.0-1062.49.1.el7
    fixed: vendor fix RHSA-2021:1531
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.4) kernel-debuginfo-common-x86_64 3.10.0-693.87.1.el7
    fixed: vendor fix RHSA-2021:2164
  • Red Hat Enterprise Linux Server Optional TUS (v. 7.6) kernel-debuginfo-common-x86_64 3.10.0-957.76.1.el7
    fixed: vendor fix RHSA-2021:2355
  • Red Hat Enterprise Linux Server TUS (v. 7.4) perf 3.10.0-693.87.1.el7, kernel 3.10.0-693.87.1.el7, python-perf 3.10.0-693.87.1.el7, kernel-tools 3.10.0-693.87.1.el7, kernel-tools-libs 3.10.0-693.87.1.el7, kernel-abi-whitelists 3.10.0-693.87.1.el7, +1 more
    fixed: vendor fix RHSA-2021:2164
  • Red Hat Enterprise Linux Server TUS (v. 7.6) perf 3.10.0-957.76.1.el7, kernel 3.10.0-957.76.1.el7, bpftool 3.10.0-957.76.1.el7, python-perf 3.10.0-957.76.1.el7, kernel-tools 3.10.0-957.76.1.el7, kernel-tools-libs 3.10.0-957.76.1.el7, +2 more
    fixed: vendor fix RHSA-2021:2355
  • Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-1160.21.1.el7, kernel 3.10.0-1160.21.1.el7, bpftool 3.10.0-1160.21.1.el7, python-perf 3.10.0-1160.21.1.el7, kernel-tools 3.10.0-1160.21.1.el7, kernel-tools-libs 3.10.0-1160.21.1.el7, +2 more Red Hat Enterprise Linux Workstation Optional (v. 7) kernel-debuginfo-common-x86_64 3.10.0-1160.21.1.el7
    fixed: vendor fix RHSA-2021:0856
  • Red Hat CodeReady Linux Builder EUS (v. 8.1) perf-debuginfo 4.18.0-147.43.1.el8_1, bpftool-debuginfo 4.18.0-147.43.1.el8_1, kernel-tools-debuginfo 4.18.0-147.43.1.el8_1, python3-perf-debuginfo 4.18.0-147.43.1.el8_1, kernel-tools-libs-devel 4.18.0-147.43.1.el8_1
    not affected: vulnerable code not present

1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-074-07 updated cvss 7.4

Siemens SIMATIC

  • Siemens SIMATIC RF160B (6GT2003-0FA00) <V2.2
    affected: mitigation “Siemens has released a new version (V2.2) for SIMATIC RF160B and recommends to update to the latest version.” siemens.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-21-131-03 updated cvss 7.4

Siemens Linux-based Products (Update J)

  • Siemens RUGGEDCOM RM1224 family (6GK6108-4AM00) >=V5.0_and_<V6.4 Siemens SCALANCE M-800 family >=V5.0_and_<V6.4 Siemens SCALANCE S615 (6GK5615-0AA00-2AA2) >=V5.0_and_<V6.4
    affected: fixed in V6.4, mitigation support.industry.siemens.com
  • Siemens SCALANCE SC-600 family <V2.1.3
    affected: fixed in V2.1.3, mitigation support.industry.siemens.com
  • Siemens SCALANCE W1750D 8.3.0.1, 8.6.0, 8.7.0
    affected: fixed in V8.7.1.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00) <>_V1.0_and_V1.6 Siemens SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00) <>_V1.0_and_V1.6
    affected: fixed in V1.6, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) >=V3.1.39_<V3.3
    affected: fixed in V3.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) >=V3.1.39_and_<V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) >=V3.1.39_and_<V3.3 Siemens SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0) >=V3.1.39_and_<V3.3
    affected: fixed in V3.3, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) >=V3.1.39_and_<V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
show 10 more
  • Siemens SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) >=V2.0_<V2.2.28 Siemens SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) >=V2.0_<V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1543-1 (incl. SIPLUS variants) >=V2.2_and_<V3.0
    affected: fixed in V3.0, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) >=V2.0_<V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0) <V1.1
    affected: fixed in V1.1, mitigation support.industry.siemens.com
  • Siemens SIMATIC MV540 H (6GF3540-0GE10) <V3.1 Siemens SIMATIC MV540 S (6GF3540-0CD10) <V3.1 Siemens SIMATIC MV550 H (6GF3550-0GE10) <V3.1 Siemens SIMATIC MV550 S (6GF3550-0CD10) <V3.1 Siemens SIMATIC MV560 U (6GF3560-0LE10) <V3.1 Siemens SIMATIC MV560 X (6GF3560-0HE10) <V3.1
    affected: fixed in V3.1, mitigation support.industry.siemens.com
  • Siemens SINEMA Remote Connect Server <V3.0_SP1
    affected: fixed in V3.0, mitigation support.industry.siemens.com
  • Siemens SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) >=V2.0_<V2.2.28 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) >=V2.0_<V2.2.28 Siemens SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) >=V2.0_<V2.2.28
    affected: fixed in V2.2.28, mitigation support.industry.siemens.com
  • Siemens SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) >=V3.1.39_<V3.3
    affected: fixed in V3.3, mitigation support.industry.siemens.com
  • Siemens SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) >=V3.1.39_and_<V3.3.46 Siemens SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) >=V3.1.39_and_<V3.3.46
    affected: fixed in V3.3.46, mitigation support.industry.siemens.com
  • Siemens SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) <V2.2_Update_1 Siemens TIM 1531 IRC (6GK7543-1MX00-0XE0) <V2.2_Update_1
    affected: fixed in V2.2, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

6.69% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • n/a Siemens Lunux Based Products

Classification

Weakness
  • CWE-330 Use of Insufficiently Random Values
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.