Security readout for executives and security teams
Plain-English summary
Older Siemens SIMATIC S7-1200 industrial controllers can be tricked by attackers who sit on the network between the controller and the engineering laptop. The attacker can record legitimate commands and replay them later, including a command to halt the controller, even if a password is set. This affects industrial process safety and uptime.
Executive priority
Treat as high priority for any plant still running legacy S7-1200 V1/V2 controllers, as a successful replay can halt production. Schedule firmware upgrades during planned maintenance windows and confirm OT segmentation is enforced. If these CPUs are not in your environment, this CVE is informational only.
Technical view
Siemens SIMATIC S7-1200 CPU V1 and V2 families (including SIPLUS variants) prior to firmware V2.0.2 are susceptible to a capture-replay weakness (CWE-294) in the proprietary protocol used between the engineering software (TIA/STEP 7) and the PLC. An on-path adversary can capture authenticated session traffic and later replay arbitrary recorded commands, such as STOP, without needing the configured password.
Likely exposure
Exposure is limited to operational technology environments still running legacy V1/V2 S7-1200 firmware where the engineering network is reachable by an attacker. Flat networks, shared L2 segments, or weak segmentation between IT and OT increase risk significantly. Devices upgraded to V2.0.2 or later, or successor S7-1200 families, are not in scope.
Exploitation context
No public reports of in-the-wild exploitation are cited in the source bundle, and CISA KEV does not list this CVE. Exploitation requires on-path network access between the engineering workstation and the PLC, which limits opportunistic attacks but is realistic for insiders or attackers who have pivoted into the OT segment.
Researcher notes
CWE-294 authentication-bypass-by-capture-replay against the legacy S7-1200 engineering protocol; password configuration on the PLC does not mitigate because the replay reuses authenticated session material. CVSS 4.0 vector indicates network attack with passive on-path requirement (AT:P), high integrity and availability impact on the controller, no confidentiality impact. Validate fix at firmware V2.0.2 boundary; review Siemens SSA-625789 for full affected list and any compensating controls.
Mitigation direction
- Upgrade affected S7-1200 V1/V2 CPUs to firmware V2.0.2 or later per Siemens advisory SSA-625789.
- Isolate PLC and engineering networks behind firewalls and restrict access to trusted engineering workstations only.
- Apply Siemens defense-in-depth and operational guidelines for industrial security on all S7-1200 deployments.
- If upgrade is not possible, replace end-of-life V1/V2 hardware with currently supported S7-1200 models.
- Monitor engineering protocol traffic for anomalous or replayed command sequences.
Validation and detection
- Inventory all SIMATIC S7-1200 CPUs and record firmware versions to identify units below V2.0.2.
- Confirm whether SIPLUS variants are present and apply the same firmware check.
- Review network architecture to verify engineering traffic to PLCs is segmented and not on shared user networks.
- Cross-reference assets against Siemens advisory SSA-625789 to confirm remediation status.
- Verify upgraded controllers report V2.0.2 or later via TIA Portal after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-294: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2011-20002 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.3HighVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://cert-portal.siemens.com/productcert/html/ssa-625789.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.