CVE-2023-36521

Name of the Vulnerable Software and Affected Versions SIMATIC MV540 H versions prior to V3.3.4 SIMATIC MV540 S versions prior to V3.3.4 SIMATIC MV550 H versions prior to V3.3.4 SIMATIC MV550 S versions prior to V3.3.4 SIMATIC MV560 U versions prior to V3.3.4 SIMATIC MV560 X versions prior to V3.3.4

Description A vulnerability in the result synchronization server of the affected products may lead to a denial of service condition. An attacker may cause a denial of service situation of all socket-based communication of the affected products if the result server is enabled. The vulnerability is related to unlimited resource allocation, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For SIMATIC MV540 H versions prior to V3.3.4, update to version V3.3.4 or later to resolve the issue. For SIMATIC MV540 S versions prior to V3.3.4, update to version V3.3.4 or later to resolve the issue. For SIMATIC MV550 H versions prior to V3.3.4, update to version V3.3.4 or later to resolve the issue. For SIMATIC MV550 S versions prior to V3.3.4, update to version V3.3.4 or later to resolve the issue. For SIMATIC MV560 U versions prior to V3.3.4, update to version V3.3.4 or later to resolve the issue. For SIMATIC MV560 X versions prior to V3.3.4, update to version V3.3.4 or later to resolve the issue. As a temporary workaround, consider disabling the result synchronization server until a patch is available.