Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that includ
Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack.
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller | 0 |
| Siemens | Development/Evaluation Kits for PROFINET IO: EK | ERTEC 200 — All Versions < V4.5 |
| Siemens | Development/Evaluation Kits for PROFINET IO: EK | ERTEC 200P — All Versions < V4.6 |
| Siemens | PROFINET Driver for Controller | All Versions < V2.1 |
| Siemens | RUGGEDCOM RM1224 family | All versions < V4.3 |
| Siemens | SCALANCE M804PB | All versions < V4.3 |
| Siemens | SCALANCE M812 | 1 ADSL-Router — All versions < V4.3 |
| Siemens | SCALANCE M812 | 1 ADSL-Router — All versions < V4.3 |
| Siemens | SCALANCE M816 | 1 ADSL-Router — All versions < V4.3 |
| Siemens | SCALANCE M816 | 1 ADSL-Router — All versions < V4.3 |
| Siemens | SCALANCE M826 | 2 SHDSL-Router — All versions < V4.3 |
| Siemens | SCALANCE M874 | 2 — All versions < V4.3 |
| Siemens | SCALANCE M874 | 3 — All versions < V4.3 |
| Siemens | SCALANCE M876 | 3 — All versions < V4.3 |
| Siemens | SCALANCE M876 | 3 (ROK) — All versions < V4.3 |
| Siemens | SCALANCE M876 | 4 (EU) — All versions < V4.3 |
| Siemens | SCALANCE M876 | 4 (NAM) — All versions < V4.3 |
| Siemens | SCALANCE S615 LAN | Router — All versions < V4.3 |
| Siemens | SCALANCE W | 700 IEEE 802.11n family — All versions <= V6.0.1 |
| Siemens | SCALANCE X200 | 4P IRT — All Versions < V5.3 |
| Siemens | SCALANCE X201 | 3P IRT — All Versions < V5.3 |
| Siemens | SCALANCE X201 | 3P IRT PRO — All Versions < V5.3 |
| Siemens | SCALANCE X202 | 2IRT — All Versions < V5.3 |
| Siemens | SCALANCE X202 | 2P IRT — All Versions < V5.3 |
| Siemens | SCALANCE X202 | 2P IRT PRO — All Versions < V5.3 |
| Siemens | SCALANCE X204 | 2 — All versions < V5.2.5 |
| Siemens | SCALANCE X204 | 2FM — All versions < V5.2.5 |
| Siemens | SCALANCE X204 | 2LD — All versions < V5.2.5 |
| Siemens | SCALANCE X204 | 2LD TS — All versions < V5.2.5 |
| Siemens | SCALANCE X204 | 2TS — All versions < V5.2.5 |
| Siemens | SCALANCE X204IRT | All Versions < V5.3 |
| Siemens | SCALANCE X204IRT PRO | All Versions < V5.3 |
| Siemens | SCALANCE X206 | 1 — All versions < V5.2.5 |
| Siemens | SCALANCE X206 | 1LD — All versions < V5.2.5 |
| Siemens | SCALANCE X208 | All versions < V5.2.5 |
| Siemens | SCALANCE X208PRO | All versions < V5.2.5 |
| Siemens | SCALANCE X212 | 2 — All versions < V5.2.5 |
| Siemens | SCALANCE X212 | 2LD — All versions < V5.2.5 |
| Siemens | SCALANCE X216 | All versions < V5.2.5 |
| Siemens | SCALANCE X224 | All versions < V5.2.5 |
| Siemens | SCALANCE X302 | 7 EEC (230V, coated) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (230V) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (24V, coated) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (24V) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (2x 230V, coated) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (2x 230V) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (2x 24V, coated) — All versions < V4.1.4 |
| Siemens | SCALANCE X302 | 7 EEC (2x 24V) — All versions < V4.1.4 |
| Siemens | SCALANCE X304 | 2FE — All versions < V4.1.4 |
| Siemens | SCALANCE X306 | 1LD FE — All versions < V4.1.4 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.