# CVE-2025-40944: Denial-of-Service Vulnerability in Siemens SIMATIC ET 200 Devices (SSA-674753)

> Siemens SIMATIC ET 200 interface modules and PN couplers do not properly handle S7 protocol session disconnects. A single valid S7 Disconnect Request (COTP DR TPDU) sent to TCP port 102 leaves the device in an improper session state, potentially unresponsive until power cycled. No exploitation or public PoC is reported.

- **Published:** 2026-11-05T05:20:37Z
- **Last reviewed:** 2026-11-05T05:20:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5298
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5298.png
- **ID:** TL-2026-5298
- **Severity:** HIGH (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10
- **CVEs:** CVE-2025-40944

## Description

CVE-2025-40944 (CWE-400, Uncontrolled Resource Consumption) affects a range of Siemens SIMATIC ET 200 distributed I/O interface modules, SIPLUS variants and PN couplers. According to Siemens ProductCERT advisory SSA-674753 (published 2026-01-13), the affected devices do not properly handle S7 protocol session disconnect requests. When a valid S7 Disconnect Request (a COTP Disconnect Request, DR TPDU) is received on TCP port 102 (ISO-on-TCP, the standard S7 communication port), the device enters an improper session state and can become unresponsive. Recovery requires a power cycle.

The flaw is reachable over the network without authentication or user interaction (CVSS v3.1 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; CVSS v4.0 8.7). Impact is limited to availability: no confidentiality or integrity impact is rated. In an OT context, loss of an ET 200 interface module or coupler can cut the controller's connection to its distributed I/O and disrupt the associated process until an operator physically power-cycles the device.

Affected products and remediation status vary. No fix is planned for SIMATIC ET 200AL IM 157-1 PN (all versions), ET 200MP IM 155-5 PN HF and its SIPLUS variants (>=V4.2.0), ET 200SP IM 155-6 MF HF (all versions) and the SIMATIC PN/MF Coupler (all versions). Fixes are available for ET 200SP IM 155-6 PN HA (V1.3), ET 200SP IM 155-6 PN R1 (V6.0.1), ET 200SP IM 155-6 PN/2 HF and SIPLUS variants (V4.2.5, added in advisory revision 1.2 on 2026-06-09), ET 200SP IM 155-6 PN/3 HF (V4.2.2), and the PN/PN Coupler and SIPLUS NET PN/PN Coupler (V6.0.0).

Siemens recommends restricting network access to the S7 communication path and filtering TCP port 102 so that only trusted IP addresses can reach affected devices, using external firewalls. The issue was coordinated by Aitor Ruiz Larrea (Mytra Control). The advisory lists no known exploitation and no IOCs, and NVD/CISA SSVC data shows the CVE is not in the CISA KEV catalog (exploitation: none). NVD analysis status is Deferred. No network IOCs exist, so no BeaconBeagle correlation applies.

## MITRE ATT&CK

- T0814 Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ET 200 S7 Service Silent After Active Baseline (Unresponsive Until Power Cycle)** (`TL-2026-5298-SPL-002`)

Detects an OT destination that carried regular tcp/102 (S7comm) sessions over the past 24 hours but shows none in the last 30 minutes. After a CVE-2025-40944 S7 Disconnect Request, affected ET 200 interface modules and PN couplers stay unresponsive until power cycled, causing loss of availability and loss of control of distributed I/O (T0826, T0813, T0816, T0814). The Sigma form approximates absence with repeated failed handshakes to the same host.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T0826, T0813, T0816, T0814
- **Data sources:** zeek:bro:conn:json, firewall:CommonSecurityLog
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=zeek sourcetype="bro:conn:json" id.resp_p=102 proto=tcp earliest=-24h@h
| rename id.resp_h AS dest
| stats count AS sessions_24h count(eval(_time >= relative_time(now(), "-30m"))) AS sessions_30m latest(_time) AS last_seen by dest
| where sessions_24h >= 20 AND sessions_30m = 0
| eval last_seen=strftime(last_seen, "%F %T")
| table dest sessions_24h sessions_30m last_seen
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 102 and Protocol =~ "TCP"
| summarize Sessions24h=count(), Sessions30m=countif(TimeGenerated > ago(30m)), LastSeen=max(TimeGenerated) by DestinationIP
| where Sessions24h >= 20 and Sessions30m == 0
| project DestinationIP, Sessions24h, Sessions30m, LastSeen
```

### Sigma

```yaml
title: Repeated Failed TCP/102 Handshakes to ET 200 Device (Unresponsive S7 Service)
id: 6d0f9a14-2c7b-4e83-b5a9-1f4c8e3d72b6
name: s7_failed_handshake_tcp102
status: experimental
description: Base rule for Zeek connections to tcp/102 that never complete (no reply, rejected or reset). Paired with the correlation rule below it flags a device that stopped answering S7 sessions, the observable impact of CVE-2025-40944 where ET 200 devices stay unresponsive until power cycled. This is a proxy for the silent-device logic used in the SPL and KQL forms.
references:
    - https://cert-portal.siemens.com/productcert/html/ssa-674753.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-40944
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.impact
    - attack.t1499
    - attack.t0826
    - attack.t0813
    - attack.t0816
    - cve.2025.40944
logsource:
    product: zeek
    service: conn
detection:
    selection:
        id.resp_p: 102
        proto: tcp
        conn_state:
            - S0
            - REJ
            - RSTOS0
    condition: selection
falsepositives:
    - Planned device maintenance, firmware updates or power cycling
level: medium
---
title: ET 200 Device Not Completing S7 Sessions on TCP/102 (Burst)
id: 0e8b4c27-9f13-4a65-8d70-c2a15b6e9d38
status: experimental
description: Five or more failed tcp/102 handshakes to the same destination within 15 minutes.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
    - attack.impact
    - attack.t0826
    - cve.2025.40944
correlation:
    type: event_count
    rules:
        - s7_failed_handshake_tcp102
    group-by:
        - id.resp_h
    timespan: 15m
    condition:
        gte: 5
falsepositives:
    - Planned device maintenance, firmware updates or power cycling
level: high

```

**Known false positives:**

- Planned maintenance, firmware update or power cycle of the ET 200 device or its upstream switch
- Devices that are only polled intermittently over tcp/102 (PROFINET RT traffic does not use tcp/102)

**Tuning notes:** Raise sessions_24h threshold for chatty devices and restrict to destinations that have a persistent S7 peer (HMI/SCADA/PLC). Schedule every 15 minutes and suppress during change windows. Correlate hits with SPL-001 / KQL-001 first-seen peer alerts in the preceding hour.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Internet or Non-Private Source Reaching ET 200 S7comm Service on TCP/102 (Allowed) (locked: unlock with TL Creds)
- Repeated Short-Lived S7comm Sessions From One Source to One ET 200 Device (locked: unlock with TL Creds)
- Scripting or Network Tool Process Connecting to TCP/102 (S7comm DoS Tooling) (locked: unlock with TL Creds)
- Minimal-Payload Short S7comm Session to TCP/102 (Connect-Disconnect Probe) (locked: unlock with TL Creds)
- Burst of Failed TCP/102 Handshakes to One ET 200 Device (Service Unresponsive) (locked: unlock with TL Creds)
- Burst of Blocked TCP/102 Attempts From One Source (Pre-Exploitation Probing) (locked: unlock with TL Creds)
- First-Seen S7comm Peer Connecting to ET 200 Device on TCP/102 (CVE-2025-40944) (locked: unlock with TL Creds)
- Single Host Fanning Out S7comm Sessions Across Multiple ET 200 Devices (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Siemens Security Advisory SSA-674753: Denial-of-Service Vulnerability in ET 200 Devices](https://cert-portal.siemens.com/productcert/html/ssa-674753.html)
- [NVD: CVE-2025-40944](https://nvd.nist.gov/vuln/detail/CVE-2025-40944)
- [Tenable OT: Siemens SIMATIC and SIPLUS products Uncontrolled Resource Consumption (CVE-2025-40944)](https://www.tenable.com/plugins/ot/505099)
- [SentinelOne Vulnerability Database: CVE-2025-40944](https://www.sentinelone.com/vulnerability-database/cve-2025-40944/)
- [Aviatrix Threat Research Center: Siemens 2026 Denial of Service Vulnerability SIMATIC/SIPLUS](https://aviatrix.ai/threat-research-center/siemens-2026-denial-of-service-vulnerability-simatic-siplus)
- [OpenCVE: CVE-2025-40944](https://app.opencve.io/cve/CVE-2025-40944)
- [VulDB: CVE-2025-40944 in SIMATIC ET 200AL IM 157-1 PN](https://vuldb.com/cve/CVE-2025-40944)
- [MITRE ATT&CK for ICS: T0814 Denial of Service](https://attack.mitre.org/techniques/T0814/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5298