FKIE_CVE-2016-9158

Vulnerability from fkie_nvd - Published: 2016-12-17 03:59 - Updated: 2026-06-17 00:55
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions). Specially crafted packets sent to port 80/tcp could cause the affected devices to go into defect mode. A cold restart is required to recover the system.
References
productcert@siemens.comhttp://www.securityfocus.com/bid/94820
productcert@siemens.comhttp://www.securitytracker.com/id/1037434
productcert@siemens.comhttps://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf
productcert@siemens.comhttps://ics-cert.us-cert.gov/advisories/ICSA-16-348-05
productcert@siemens.comhttps://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94820
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037434
af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf
af854a3a-2127-422b-91ae-364da2661108https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05
af854a3a-2127-422b-91ae-364da2661108https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf
Impacted products
Vendor Product Version
siemens simatic_s7-300_cpu_firmware -
siemens simatic_s7-300_cpu_312 -
siemens simatic_s7-300_cpu_314 -
siemens simatic_s7-300_cpu_315-2_dp -
siemens simatic_s7-300_cpu_315-2_pn\/dp -
siemens simatic_s7-300_cpu_317-_2_dp -
siemens simatic_s7-300_cpu_317-2_pn\/dp -
siemens simatic_s7-300_cpu_319-3_pn\/dp -
siemens simatic_s7-400_cpu_firmware -
siemens simatic_s7-400_cpu_412-1 -
siemens simatic_s7-400_cpu_412-2 -
siemens simatic_s7-400_cpu_412-2_pn -
siemens simatic_s7-400_cpu_414-2 -
siemens simatic_s7-400_cpu_414-3 -
siemens simatic_s7-400_cpu_414-3_pn\/dp -
siemens simatic_s7-400_cpu_416-2 -
siemens simatic_s7-400_cpu_416-3 -
siemens simatic_s7-400_cpu_416-3_pn\/dp -
siemens simatic_s7-400_cpu_416f-2 -
siemens simatic_s7-400_cpu_416f-3_pn\/dp -
siemens simatic_s7-400_cpu_417-4 -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "SIMATIC S7-300 CPU family",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "product": "SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "product": "SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "product": "SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants)",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "product": "SIMATIC S7-400 V6 and earlier CPU family",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "product": "SIMATIC S7-400 V7 CPU family",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ],
      "source": "productcert@siemens.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_s7-300_cpu_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "76189399-9032-4695-A976-8415E26B0DB8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_312:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4FB328F8-3E03-440B-AB5C-ADA1D4F07F0E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_314:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "78399465-EED5-4EBD-A2E1-6FE0BD01EDB4",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_315-2_dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8FD8E6D-0527-4215-B6F0-5824011433FB",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_315-2_pn\\/dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A773F92D-E5C0-4B51-8214-19BFE6BC7638",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_317-_2_dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3C5065F-C0B9-4427-A9D2-072AFF3FCA69",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_317-2_pn\\/dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A340DA65-BA46-4F72-8951-93135F9F6602",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-300_cpu_319-3_pn\\/dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7167E5B0-D278-4F63-B5CD-39DBDF336089",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:simatic_s7-400_cpu_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6EBD5F0-16A6-466B-80E5-B95DDBDE2FA3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_412-1:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6498C679-46A3-4F87-9278-F64D2194E1F5",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_412-2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "85F8C306-45F5-429B-B932-0278A9B909B7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_412-2_pn:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0E162F8-B37A-4FFA-A523-FA6227372D37",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_414-2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CD1CA5C-F729-4311-9E78-156BB6DE31A7",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_414-3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "20E69856-A628-4B9D-9184-7FB9A924193E",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_414-3_pn\\/dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1EC8F19-313A-4C74-A68A-AAC320B123CE",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_416-2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "195259DF-8ABE-47A9-9A13-6BDAA25AA898",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_416-3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3412299F-5778-4290-A80C-29BC6F46F701",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_416-3_pn\\/dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CC41E925-88AF-4D33-AC49-CE5FEAAF2105",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_416f-2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "61363AEF-CBDB-4405-A605-4997798D38D8",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_416f-3_pn\\/dp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CFC71AB-3ACF-4E7E-B83E-31E02DEBDA48",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:siemens:simatic_s7-400_cpu_417-4:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "711A91B2-EB16-418B-AA63-56DFD40075D7",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SIMATIC S7-300 CPU family (All versions), SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 V6 and earlier CPU family (All versions), SIMATIC S7-400 V7 CPU family (All versions). Specially crafted packets sent to port 80/tcp could cause the affected devices to go into defect mode. A cold restart is required to recover the system."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en la familia de CPU SIMATIC S7-300 (todas las versiones), la familia de CPU SIMATIC S7-300 (incluidas las CPU ET200 relacionadas y las variantes SIPLUS) (todas las versiones), SIMATIC S7-400 PN / DP V6 y familias de CPU inferiores (incl. variantes SIPLUS) (todas las versiones), familia de CPU SIMATIC S7-400 PN / DP V7 (incl. variantes SIPLUS) (todas las versiones), SIMATIC S7-400 V6 y familia de CPU anterior (todas las versiones), SIMATIC S7-400 Familia de CPU V7 (todas las versiones). Los paquetes especialmente dise\u00f1ados enviados al puerto 80 / tcp podr\u00edan hacer que los dispositivos afectados entren en modo defectuoso. Se requiere un reinicio en fr\u00edo para recuperar el sistema."
    }
  ],
  "id": "CVE-2016-9158",
  "lastModified": "2026-06-17T00:55:36.433",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.8,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2016-9158",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-02T18:32:34.820675Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2016-12-17T03:59:00.187",
  "references": [
    {
      "source": "productcert@siemens.com",
      "url": "http://www.securityfocus.com/bid/94820"
    },
    {
      "source": "productcert@siemens.com",
      "url": "http://www.securitytracker.com/id/1037434"
    },
    {
      "source": "productcert@siemens.com",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf"
    },
    {
      "source": "productcert@siemens.com",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05"
    },
    {
      "source": "productcert@siemens.com",
      "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/94820"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1037434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-731239.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-348-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-731239.pdf"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.