CVE-2025-40944: Denial-of-Service Vulnerability in Siemens SIMATIC ET 200 Devices (SSA-674753)

Key facts for Siemens ET 200 S7 DoS

Detection coverage for Siemens ET 200 S7 DoS

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5298 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ET 200 S7 Service Silent After Active Baseline (Unresponsive Until Power Cycle)

Detects an OT destination that carried regular tcp/102 (S7comm) sessions over the past 24 hours but shows none in the last 30 minutes. After a CVE-2025-40944 S7 Disconnect Request, affected ET 200 interface modules and PN couplers stay unresponsive until power cycled, causing loss of availability and loss of control of distributed I/O (T0826, T0813, T0816, T0814). The Sigma form approximates absence with repeated failed handshakes to the same host.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T0826, T0813, T0816, T0814
• Data sources: zeek:bro:conn:json, firewall:CommonSecurityLog
• Severity: high
• Confidence: medium

Splunk SPL

index=zeek sourcetype="bro:conn:json" id.resp_p=102 proto=tcp earliest=-24h@h
| rename id.resp_h AS dest
| stats count AS sessions_24h count(eval(_time >= relative_time(now(), "-30m"))) AS sessions_30m latest(_time) AS last_seen by dest
| where sessions_24h >= 20 AND sessions_30m = 0
| eval last_seen=strftime(last_seen, "%F %T")
| table dest sessions_24h sessions_30m last_seen

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 102 and Protocol =~ "TCP"
| summarize Sessions24h=count(), Sessions30m=countif(TimeGenerated > ago(30m)), LastSeen=max(TimeGenerated) by DestinationIP
| where Sessions24h >= 20 and Sessions30m == 0
| project DestinationIP, Sessions24h, Sessions30m, LastSeen

Sigma

title: Repeated Failed TCP/102 Handshakes to ET 200 Device (Unresponsive S7 Service)
id: 6d0f9a14-2c7b-4e83-b5a9-1f4c8e3d72b6
name: s7_failed_handshake_tcp102
status: experimental
description: Base rule for Zeek connections to tcp/102 that never complete (no reply, rejected or reset). Paired with the correlation rule below it flags a device that stopped answering S7 sessions, the observable impact of CVE-2025-40944 where ET 200 devices stay unresponsive until power cycled. This is a proxy for the silent-device logic used in the SPL and KQL forms.
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-674753.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40944
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.impact
    - attack.t1499
    - attack.t0826
    - attack.t0813
    - attack.t0816
    - cve.2025.40944
logsource:
    product: zeek
    service: conn
detection:
    selection:
        id.resp_p: 102
        proto: tcp
        conn_state:
            - S0
            - REJ
            - RSTOS0
    condition: selection
falsepositives:
    - Planned device maintenance, firmware updates or power cycling
level: medium
---
title: ET 200 Device Not Completing S7 Sessions on TCP/102 (Burst)
id: 0e8b4c27-9f13-4a65-8d70-c2a15b6e9d38
status: experimental
description: Five or more failed tcp/102 handshakes to the same destination within 15 minutes.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.impact
    - attack.t0826
    - cve.2025.40944
correlation:
    type: event_count
    rules:
        - s7_failed_handshake_tcp102
    group-by:
        - id.resp_h
    timespan: 15m
    condition:
        gte: 5
falsepositives:
    - Planned device maintenance, firmware updates or power cycling
level: high

Known false positives:

• Planned maintenance, firmware update or power cycle of the ET 200 device or its upstream switch
• Devices that are only polled intermittently over tcp/102 (PROFINET RT traffic does not use tcp/102)

Tuning notes: Raise sessions_24h threshold for chatty devices and restrict to destinations that have a persistent S7 peer (HMI/SCADA/PLC). Schedule every 15 minutes and suppress during change windows. Correlate hits with SPL-001 / KQL-001 first-seen peer alerts in the preceding hour.

• 🔒 Internet or Non-Private Source Reaching ET 200 S7comm Service on TCP/102 (Allowed) · unlock with TL Creds
• 🔒 Repeated Short-Lived S7comm Sessions From One Source to One ET 200 Device · unlock with TL Creds
• 🔒 Scripting or Network Tool Process Connecting to TCP/102 (S7comm DoS Tooling) · unlock with TL Creds
• 🔒 Minimal-Payload Short S7comm Session to TCP/102 (Connect-Disconnect Probe) · unlock with TL Creds
• 🔒 Burst of Failed TCP/102 Handshakes to One ET 200 Device (Service Unresponsive) · unlock with TL Creds
• 🔒 Burst of Blocked TCP/102 Attempts From One Source (Pre-Exploitation Probing) · unlock with TL Creds
• 🔒 First-Seen S7comm Peer Connecting to ET 200 Device on TCP/102 (CVE-2025-40944) · unlock with TL Creds
• 🔒 Single Host Fanning Out S7comm Sessions Across Multiple ET 200 Devices · unlock with TL Creds

Indicators of compromise for Siemens ET 200 S7 DoS

As of 2026-11-05, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5298.

How Siemens ET 200 S7 DoS works

No exploitation or public PoC is reported.

CVE-2025-40944 (CWE-400, Uncontrolled Resource Consumption) affects a range of Siemens SIMATIC ET 200 distributed I/O interface modules, SIPLUS variants and PN couplers. According to Siemens ProductCERT advisory SSA-674753 (published 2026-01-13), the affected devices do not properly handle S7 protocol session disconnect requests. When a valid S7 Disconnect Request (a COTP Disconnect Request, DR TPDU) is received on TCP port 102 (ISO-on-TCP, the standard S7 communication port), the device enters an improper session state and can become unresponsive. Recovery requires a power cycle.

The flaw is reachable over the network without authentication or user interaction (CVSS v3.1 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; CVSS v4.0 8.7). Impact is limited to availability: no confidentiality or integrity impact is rated. In an OT context, loss of an ET 200 interface module or coupler can cut the controller's connection to its distributed I/O and disrupt the associated process until an operator physically power-cycles the device.

Affected products and remediation status vary. No fix is planned for SIMATIC ET 200AL IM 157-1 PN (all versions), ET 200MP IM 155-5 PN HF and its SIPLUS variants (>=V4.2.0), ET 200SP IM 155-6 MF HF (all versions) and the SIMATIC PN/MF Coupler (all versions). Fixes are available for ET 200SP IM 155-6 PN HA (V1.3), ET 200SP IM 155-6 PN R1 (V6.0.1), ET 200SP IM 155-6 PN/2 HF and SIPLUS variants (V4.2.5, added in advisory revision 1.2 on 2026-06-09), ET 200SP IM 155-6 PN/3 HF (V4.2.2), and the PN/PN Coupler and SIPLUS NET PN/PN Coupler (V6.0.0).

Siemens recommends restricting network access to the S7 communication path and filtering TCP port 102 so that only trusted IP addresses can reach affected devices, using external firewalls. The issue was coordinated by Aitor Ruiz Larrea (Mytra Control). The advisory lists no known exploitation and no IOCs, and NVD/CISA SSVC data shows the CVE is not in the CISA KEV catalog (exploitation: none). NVD analysis status is Deferred. No network IOCs exist, so no BeaconBeagle correlation applies.

MITRE ATT&CK techniques by tactic:

Inhibit Response Function

T0814 Denial of Service

Remediation for Siemens ET 200 S7 DoS

Patches

• SIMATIC ET 200SP IM 155-6 PN HA: update to V1.3 or later
• SIMATIC ET 200SP IM 155-6 PN R1: update to V6.0.1 or later
• SIMATIC ET 200SP IM 155-6 PN/2 HF and SIPLUS ET 200SP IM 155-6 PN HF variants: update to V4.2.5 or later
• SIMATIC ET 200SP IM 155-6 PN/3 HF: update to V4.2.2 or later
• SIMATIC PN/PN Coupler and SIPLUS NET PN/PN Coupler: update to V6.0.0 or later

Immediate actions

• Restrict network access to the S7 communication path of affected ET 200 devices and couplers
• Filter TCP port 102 with external firewalls so only trusted IP addresses can reach affected devices

Workarounds

• No fix planned for ET 200AL IM 157-1 PN, ET 200MP IM 155-5 PN HF (and SIPLUS variants), ET 200SP IM 155-6 MF HF and PN/MF Coupler: rely on network access restriction and TCP/102 filtering

Longer-term hardening

• Segment OT networks and keep S7/ISO-on-TCP traffic inside defined cell/area zones
• Monitor TCP/102 for unexpected COTP Disconnect Request (DR) TPDUs from non-engineering hosts
• Plan replacement or compensating controls for products with no fix planned

Affected and fixed versions

• Siemens — SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0)
  Vulnerable versions: All versions
  Fixed in: No fix planned
• Siemens — SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0)
  Vulnerable versions: >=V4.2.0
  Fixed in: No fix planned
• Siemens — SIPLUS ET 200MP IM 155-5 PN HF (6AG1155-5AA00-2AC0, 6AG1155-5AA00-7AC0) and T1 RAIL (6AG2155-5AA00-1AC0)
  Vulnerable versions: >=V4.2.0
  Fixed in: No fix planned
• Siemens — SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0)
  Vulnerable versions: All versions
  Fixed in: No fix planned
• Siemens — SIMATIC ET 200SP IM 155-6 PN HA
  Vulnerable versions: <V1.3
  Fixed in: V1.3
• Siemens — SIMATIC ET 200SP IM 155-6 PN R1 (6ES7155-6AU00-0HM0)
  Vulnerable versions: <V6.0.1
  Fixed in: V6.0.1
• Siemens — SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) and SIPLUS ET 200SP IM 155-6 PN HF variants (6AG1155-6AU01-2CN0, 6AG1155-6AU01-7CN0, 6AG2155-6AU01-1CN0, 6AG2155-6AU01-4CN0)
  Vulnerable versions: >=V4.2.0 <V4.2.5
  Fixed in: V4.2.5
• Siemens — SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0)
  Vulnerable versions: <V4.2.2
  Fixed in: V4.2.2
• Siemens — SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0)
  Vulnerable versions: All versions
  Fixed in: No fix planned
• Siemens — SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) and SIPLUS NET PN/PN Coupler (6AG2158-3AD10-4XA0)
  Vulnerable versions: <V6.0.0
  Fixed in: V6.0.0

Timeline of Siemens ET 200 S7 DoS

• 2026-01-13 CISA SSVC assessment recorded in NVD: Exploitation none, Automatable yes, Technical Impact partial
• 2026-01-13 CVE-2025-40944 published to NVD with CVSS v3.1 7.5 and v4.0 8.7, CWE-400
• 2026-01-13 locked-ioc-8 publishes SSA-674753 (V1.0) describing the S7 disconnect handling DoS in SIMATIC ET 200 devices and couplers
• 2026-02-10 SSA-674753 V1.1 adds acknowledgment of locked-ioc-9 (locked-ioc-10) for coordinated disclosure
• 2026-06-09 SSA-674753 V1.2 adds a fix for SIMATIC ET 200SP IM 155-6 PN/2 HF (V4.2.5 or later)
• 2026-06-17 NVD record last modified; vulnerability status Deferred, not listed in CISA KEV (SSVC exploitation: none)

Sources cited for Siemens ET 200 S7 DoS

• Siemens Security Advisory SSA-674753: Denial-of-Service Vulnerability in ET 200 Devices cert-portal.siemens.com · Advisory · 2026-01-13
• NVD: CVE-2025-40944 NVD (NIST) · Advisory · 2026-01-13
• Tenable OT: Siemens SIMATIC and SIPLUS products Uncontrolled Resource Consumption (CVE-2025-40944) Tenable · Research
• SentinelOne Vulnerability Database: CVE-2025-40944 SentinelOne · Research
• Aviatrix Threat Research Center: Siemens 2026 Denial of Service Vulnerability SIMATIC/SIPLUS aviatrix.ai · Research
• OpenCVE: CVE-2025-40944 app.opencve.io · Research
• VulDB: CVE-2025-40944 in SIMATIC ET 200AL IM 157-1 PN vuldb.com · Research
• MITRE ATT&CK for ICS: T0814 Denial of Service MITRE · Research

More in vulnerability

• Critical Citrix XenServer Vulnerability (CVE-2026-98432, CVE-2026-102703) Could Let Attackers Take Over Virtualization Hosts Without Authentication
• Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on Siemens RUGGEDCOM APE1808 Devices (SSA-366067)
• OpenAI Cyber Model Uncovers 948 Linux Kernel Local Privilege Escalation Vulnerabilities
• Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised
• Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)