Threat video1:00
CVE-2025-40944 Siemens ET 200 S7 DoS: Detection & IOCs
A single S7 Disconnect Request can leave Siemens ET 200 devices unresponsive until power cycled. 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2025-40944 Siemens ET 200 S7 DoS: Detection & IOCs →
Chapters
- 0:00The hookS7 Disconnect leaves SIMATIC ET 200 devices unresponsive.
- 0:06The storyAdvisory disclosed S7 Disconnect vulnerability in January.
- 0:14Attack pathS7 service on port 102, no authentication.
- 0:29AttributionNo threat actor is attributed.
- 0:34Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques1 ATT&CK technique, in inhibit response function.
- 0:44Remediation2 steps now: Restrict network access to the S7 communication path of affected.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00S7 Disconnect leaves SIMATIC ET 200 devices unresponsive.
0:06Advisory disclosed S7 Disconnect vulnerability in January.
0:11Patches released, others unfixed.
0:14S7 service on port 102, no authentication.
0:18According to Siemens, one S7 Disconnect causes outage.
0:22Interface module stops responding.
0:25Distributed I/O and process go down.
0:30No threat actor is attributed. Confidence: low.
0:34No malicious indicators were published.
0:391 ATT&CK technique, in inhibit response function.
0:442 steps now: Restrict network access to the S7 communication path of affected.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.