Siemens has warned that a flaw in the way several SIMATIC and SIPLUS ET 200 devices handle S7 protocol session disconnects can be weaponized to cause a denial‑of‑service (DoS) condition: a properly formed S7 Disconnect Request (a COTP DR TPDU) sent to TCP port 102 may push the device into an improper session state and render it unresponsive until a power cycle is performed. This vulnerability is tracked as CVE‑2025‑40944, carries a CVSS v3.1 base score of 7.5 (High), and affects multiple ET 200/MP/SP couplers and IM modules across SIMATIC and SIPLUS product lines; Siemens has published per‑SKU remediation guidance and mitigations, and recommends immediate network controls where firmware fixes are not available.
Background / Overview
Industrial controllers and remote I/O couplers in the SIMATIC ET 200 family commonly expose Siemens’ S7 protocol over TCP port 102. S7 sessions rely on the
COTP (Connection Oriented Transport Protocol) layer to establish and tear down logical connections; the
Disconnect Request (DR TPDU) is the standard way for a peer to cleanly close an S7/COTP session. The issue at the heart of CVE‑2025‑40944 is not that the Disconnect packet is malformed, but that the affected devices enter an improper session state when they receive a valid COTP DR TPDU — a logic error that leads to uncontrolled resource consumption or a deadlocked session context and ultimately causes the device to stop responding to further traffic until it is power‑cycled. Siemens and national cybersecurity bodies have republished advisory information and interim protections for operators.
Why S7 over TCP port 102 matters
- Port 102/tcp is the canonical endpoint for Siemens S7 communications in most industrial networks; it’s commonly reachable from HMI/engineering hosts, diagnostics tools, and maintenance workstations.
- Because industrial devices are often long‑lived and tightly coupled to production lines, even transient loss of an IO coupler or communication module can cascade into significant process disruption.
- Attackers who can reach port 102 via network access, compromised jump hosts, or misconfigured remote‑maintenance tunnels can exploit this weakness without authentication.
The technical failure mode in plain language
When the device receives a properly formed COTP DR TPDU, its internal session state machine transitions to a state that the vendor’s implementation fails to manage correctly. Rather than gracefully completing shutdown and cleaning session resources, the implementation can become stuck in a half‑closed or inconsistent state. The end result is an
availability failure — the device becomes unresponsive to legitimate connections or requests until a physical power cycle restores internal state. This is characteristic of
uncontrolled resource consumption and session‑state management bugs (CWE‑400 and related session‑state weaknesses).
What’s affected (SKU overview and remediation status)
Siemens’ advisory lists a set of ET 200 SIMATIC and SIPLUS SKUs as known‑affected. The list includes IM modules and couplers in ET 200AL / ET 200MP / ET 200SP families and PN/PN or PN/MF couplers. A representative (non‑exhaustive) set of impacted SKUs includes:
- SIMATIC ET 200AL IM 157‑1 PN (6ES7157‑1AB00‑0AB0) — CVE‑2025‑40944.
- SIMATIC ET 200MP IM 155‑5 PN HF (6ES7155‑5AA00‑0AC0).
- SIMATIC ET 200SP IM 155‑6 MF HF (6ES7155‑6MU00‑0CN0).
- SIMATIC ET 200SP IM 155‑6 PN HA (and SIPLUS variants).
- SIMATIC ET 200SP IM 155‑6 PN R1 (6ES7155‑6AU00‑0HM0) and various PN/2 and PN/3 HF variants.
- SIMATIC PN/MF Coupler (6ES7158‑3MU10‑0XA0) and PN/PN Coupler (6ES7158‑3AD10‑0XA0).
- Multiple SIPLUS variants of the ET 200MP and ET 200SP IM modules, and SIPLUS PN/PN couplers.
Siemens has published targeted remediation guidance: for some SKUs there are updated firmware releases available (for example, IM 155‑6 PN HA to V1.3; IM 155‑6 PN/3 HF to V4.2.2; and PN/PN couplers to V6.0.0; IM 155‑6 PN R1 to V6.0.1), while several other SKUs are designated as “no fix planned” and must rely on compensating controls until further notice. Operators must map their precise SKU and firmware string to Siemens’ ProductCERT advisory to determine the correct remediation threshold for each device.
Siemens’ recommended mitigations (what to do now)
Siemens and CISA both emphasize that immediate network controls reduce exploitation risk while firmware updates are applied or when fixes are not available. The vendor and federal guidance converge on the following practical measures:
- Filter and restrict TCP port 102 — Allow S7 traffic only between trusted engineering/automation hosts and the listed device IP addresses via external firewalls or OT boundary devices. Deny any other inbound connections to port 102.
- Segment S7 traffic — Place S7 networks behind dedicated OT firewalls or VLANs; do not expose engineering interfaces to general corporate networks or the internet.
- Harden remote access — Restrict remote maintenance to hardened jump hosts or VPNs with multi‑factor authentication and tight egress rules; avoid direct routing of management ports to remote endpoints.
- Limit trusted peers — Configure device ACLs or network access lists so that only explicitly allowed IPs can establish S7 sessions.
- Monitor and log — Capture and retain PCAPs and syslog/diagnostic output for S7/TCP traffic; add IDS/IPS signatures for anomalous COTP sequences or repeated Disconnect requests.
If a device becomes unresponsive due to this issue, the short‑term recovery action indicated in vendor documentation is a power cycle. Operators should treat that as an emergency‑only recovery step and apply standard OT change and safety procedures before power‑cycling modules in production environments.
Practical triage and remediation playbook (step‑by‑step)
- Inventory: Enumerate all SIMATIC / SIPLUS ET 200 devices by SKU, serial, installed firmware version and network exposure. Use automated discovery where possible and cross‑check with procurement/asset lists.
- Prioritize: Classify devices by exposure and criticality — (A) externally reachable/remote‑accessible; (B) reachable from corporate/engineering networks; (C) isolated OT subnet. Focus first on (A) and (B).
- Patch path: For SKUs with vendor fixes, schedule staged firmware upgrades (lab test → pilot line → production) and validate both functional behavior and the intended fix in a controlled environment. Ensure rollback images or procedures are available.
- Apply compensating controls: Where fixes aren’t available or patching is delayed, enforce strict firewall ACLs to block or limit TCP/102, remove unneeded routes, and place devices behind OT jump hosts.
- Detection: Deploy IDS/packet captures at OT border points to look for repeated or unexpected COTP DR packets or session resets. Retain capture windows long enough to correlate with device reboots/unresponsiveness.
- Incident procedures: For devices that become unresponsive, follow an incident playbook: preserve logs and PCAPs, notify vendor ProductCERT, exercise controlled power cycle only after safety checks, and treat the event as potential compromise until triaged.
Detection and forensic signs to watch for
Because exploitation involves a legitimate S7/TPDU Disconnect packet, identifying malicious intent requires correlation and behavioral indicators rather than a single malformed packet signature. Recommended detection signals:
- Repeated or high‑frequency COTP DR TPDU packets directed at a single IMS/coupler IP.
- Sudden simultaneous session teardowns across multiple engineering hosts destined for the same device.
- Device stops responding to diagnostics or HMI queries and only recovers after a power cycle.
- New or unexpected routing/jump‑host connections to the engineering network coincident with DoS events.
- IDS/NetFlow anomalies showing suspicious timing patterns consistent with spoofed TCP injection or on‑path modifications.
Preserve PCAPs for incident response and forward them to Siemens ProductCERT if remediation support is required; packet traces will help determine whether the disconnects were locally originated, spoofed, or part of an on‑path tampering scenario.
Risk analysis — what this means for operators
Strengths in the vendor response
- Per‑SKU guidance: Siemens has produced a productized advisory with a specific list of affected SKUs and explicit firmware thresholds where fixes exist, enabling targeted patching and triage. This per‑SKU clarity is essential for operational teams mapping assets to remediation paths.
- Practical mitigations: The vendor and CISA recommend straightforward, well‑understood network controls — port filtering, segmentation, and restricted remote access — that can be deployed even in environments where firmware updates must be deferred.
Remaining risks and operational challenges
- No‑fix SKUs: For certain SKUs, Siemens currently lists “no fix planned.” That leaves operators reliant on compensating controls indefinitely, which raises long‑term operational and procurement concerns. Deployments that cannot be isolated or that rely on vendor‑unpatchable hardware will require legacy mitigation strategies and possibly hardware replacement.
- Exploit prerequisites in practice: Although the attack is network‑based and does not require credentials, successful exploitation often depends on network reachability and precise timing or on‑path capability (spoofing or compromised network elements). In some industrial environments the preconditions are achievable — e.g., poorly segmented networks, vendor maintenance tunnels, or compromised jump hosts — increasing the real‑world risk.
- Operational safety tradeoffs: Applying broad firewall rules or disabling remote access can interfere with legitimate maintenance and monitoring workflows. Operators must balance safety, uptime, and security when implementing mitigations, and should document any reduced functionality under formal change control.
Long‑term remediation, procurement, and governance implications
- Patch life‑cycle discipline: Establish an OT patching cadence that includes firmware verification, rollback testing, and staged deployment for controllers and couplers. Treat vendor ProductCERT advisories as high‑priority inputs to your change calendar.
- Replace unfixable hardware: For devices marked “no fix planned” and that cannot be mitigated by segmentation, plan for phased hardware replacement or architectural changes that remove exposed SKUs from critical paths.
- Network segregation as a default: Treat S7 and other control protocols as high‑value assets that must not be routable from general IT networks. Use firewalls, microsegmentation, and controlled jump hosts as default defenses.
- Vendor engagement: Maintain an institutional relationship with Siemens ProductCERT — subscribe to advisories, request per‑SKU lists, and engage support for impact analysis and post‑patch validation. Siemens’ advisory model is the canonical source for per‑SKU remediation and should be the authority for patch decisions.
What to tell executives and operations leadership
- Immediate operational impact: There is a confirmed DoS vulnerability (CVE‑2025‑40944) that can render certain ET 200 couplers and IM modules unresponsive until a power cycle; this can cause local or cascading production interruptions.
- Short‑term action: Implement strict firewalling of TCP/102, isolate engineering networks, and enforce controlled remote access. These mitigations materially reduce exploitation risk and are low to moderate cost compared with unplanned downtime.
- Medium‑term action: Patch SKUs with available firmware updates following test→pilot→production rollout; for SKUs without fixes, plan replacements or permanent network mitigations.
- Risk posture: This advisory highlights the operational risk of long‑lived OT devices that are network‑visible and the need to treat vendor advisories as an inseparable part of OT lifecycle and procurement planning.
Caveats, unknowns, and items flagged for caution
- Public exploitation status: As of the vendor advisory, there is no broad public evidence that CVE‑2025‑40944 is being exploited at scale in the wild; however, the absence of public exploit reports does not mean the vulnerability hasn’t been used in targeted intrusions. Operators should assume an active threat model proportional to the device exposure. This is standard caution when dealing with network‑accessible OT flaws.
- Per‑SKU nuance: The vendor’s SKU table is the single authoritative source for whether a given device/firmware pair is fixed or remains unpatched; condensed public summaries may omit edge cases. Always cross‑reference your device’s exact order number and build string with Siemens ProductCERT before acting.
Closing analysis — balancing urgency with operational safety
CVE‑2025‑40944 is a high‑impact availability vulnerability precisely because it targets session‑management logic in widely deployed IM/coupler modules used for distributed I/O. The attack vector is simple in concept — send a valid S7/COTP DR TPDU to TCP/102 — but the operational preconditions (network reachability and the ability to inject or spoof traffic) shape the practical risk profile. Siemens’ advisory and federal guidance supply a sensible, layered defense: where firmware fixes exist, apply them after testing; where they do not, immediately reduce network exposure and harden remote‑maintenance paths. The most defensible long‑term posture is to treat control‑plane protocols like S7 as inherently sensitive, to remove routability wherever possible, and to embed vendor advisories into OT lifecycle and procurement reviews so that unfixable devices are replaced before they become systemic liabilities.
Operators should begin with rapid inventory and exposure mapping, apply network filtering for TCP/102 to trusted peers only, and coordinate a staged patch program for SKUs with vendor updates. For modules where the vendor has not planned fixes, plan for permanent network isolation or replacement. Given the potential for production impact, these steps should be owned jointly by OT engineering, security, and plant operations, with executive awareness of the tradeoffs between uptime and mitigation measures.
This advisory is a reminder that the intersection of networking logic and long‑lived embedded devices continues to be a recurring source of operational risk; a disciplined approach — inventory, segmentation, patching, and vendor coordination — remains the most effective defense.
Source: CISA
Siemens SIMATIC and SIPLUS products | CISA