Skip to content
Fencer Intel
medium 5.3

CVE-2022-25622 json

The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the m…

published 4y ago modified 4mo ago also EUVD-2022-30282

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined.

This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.

Patch / fix

  • Siemens SIMATIC CFU DIQ V2.0.0
  • Siemens SIMATIC CFU PA V2.0.0
  • Siemens SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L V5.1.2
  • Siemens SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L V5.1.2
  • Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L V5.1.2
  • Siemens SIMATIC ET200ecoPN, DI 16x24VDC, M12-L V5.1.2
  • Siemens SIMATIC ET200ecoPN, DI 8x24VDC, M12-L V5.1.2
  • Siemens SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L V5.1.3
  • Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L V5.1.2
  • Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L V5.1.2
  • Siemens SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) V6.0.10
  • Siemens SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants) V8.2.3
  • Siemens SIMATIC TDC CP51M1 V1.1.10
  • Siemens SIMATIC TDC CPU555 V1.2.1
  • Siemens SINAMICS DCM V1.5 SP1
  • Siemens SINAMICS G110M V4.7.14
  • Siemens SINAMICS G115D V4.7.14

Is CVE-2022-25622 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-104-06 updated cvss 5.3

Siemens PROFINET Stack Integrated on Interniche Stack

  • Siemens SIMATIC CFU DIQ (6ES7655-5PX31-1XX0) < V2.0.0 Siemens SIMATIC CFU PA (6ES7655-5PX11-0XX0) < V2.0.0
    affected: fixed in V2.0.0, mitigation
  • Siemens SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) Siemens SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) >= V4.2.0
    affected: mitigation, no fix planned
  • Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU (6ES7154-8AB01-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU (6ES7154-8FB01-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU (6ES7154-8FX00-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU (6ES7151-8AB01-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU (6ES7151-8FB01-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC ET 200SP IM 155-6 MF HF (6ES7155-6MU00-0CN0) Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants) Siemens SIMATIC ET 200SP IM 155-6 PN HF (6ES7155-6AU00-0CN0) >= V4.2.0 Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF (6ES7155-6AU01-0CN0) >= V4.2.0 Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF (6ES7155-6AU30-0CN0) >= V4.2.0
    affected: mitigation, no fix planned
show 15 more
  • Siemens SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L (6ES7144-6JF00-0BB0) >= V5.1.1, < V5.1.2 Siemens SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L (6ES7148-6JE00-0BB0) >= V5.1.1, < V5.1.2 Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JG00-0BB0) >= V5.1.1, < V5.1.2 Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L (6ES7148-6JJ00-0BB0) >= V5.1.1, < V5.1.2 Siemens SIMATIC ET200ecoPN, DI 8x24VDC, M12-L (6ES7141-6BG00-0BB0) >= V5.1.1, < V5.1.2 Siemens SIMATIC ET200ecoPN, DI 16x24VDC, M12-L (6ES7141-6BH00-0BB0) >= V5.1.1, < V5.1.2
    affected: fixed in V5.1.2, mitigation
  • Siemens SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L (6ES7143-6BH00-0BB0) >= V5.1.1, < V5.1.3
    affected: fixed in V5.1.3, mitigation
  • Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L (6ES7142-6BG00-0BB0) >= V5.1.1, < V5.1.2 Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L (6ES7142-6BR00-0BB0) >= V5.1.1, < V5.1.2
    affected: fixed in V5.1.2, mitigation
  • Siemens SIMATIC PN/MF Coupler (6ES7158-3MU10-0XA0) Siemens SIMATIC PN/PN Coupler (6ES7158-3AD10-0XA0) >= 4.2
    affected: mitigation, no fix planned
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP (6ES7314-6EH04-0AB0) < V3.3.19
    affected: fixed in V3.3.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP (6ES7315-2FJ14-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP (6ES7315-7TJ10-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP (6ES7317-2FK14-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317T-3 PN/DP (6ES7317-7TK10-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP (6ES7317-7UL10-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 319-3 PN/DP (6ES7318-3EL01-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-300 CPU 319F-3 PN/DP (6ES7318-3FL01-0AB0) < V3.2.19
    affected: fixed in V3.2.19, mitigation support.industry.siemens.com
  • Siemens SIMATIC S7-400 CPU 412-2 PN V7 (6ES7412-2EK07-0AB0) Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7 (6ES7414-3EM07-0AB0) Siemens SIMATIC S7-400 CPU 414F-3 PN/DP V7 (6ES7414-3FM07-0AB0) Siemens SIMATIC S7-400 CPU 416-3 PN/DP V7 (6ES7416-3ES07-0AB0) Siemens SIMATIC S7-400 CPU 416F-3 PN/DP V7 (6ES7416-3FS07-0AB0)
    affected: mitigation, no fix planned

42 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • Siemens SIMATIC CFU DIQ
  • Siemens SIMATIC CFU PA
  • Siemens SIMATIC ET 200AL IM 157-1 PN
  • Siemens SIMATIC ET 200MP IM 155-5 PN HF
  • Siemens SIMATIC ET 200pro IM 154-8 PN/DP CPU
  • Siemens SIMATIC ET 200pro IM 154-8F PN/DP CPU
  • Siemens SIMATIC ET 200pro IM 154-8FX PN/DP CPU
  • Siemens SIMATIC ET 200S IM 151-8 PN/DP CPU
  • Siemens SIMATIC ET 200S IM 151-8F PN/DP CPU
  • Siemens SIMATIC ET 200SP IM 155-6 MF HF
  • Siemens SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants)
  • Siemens SIMATIC ET 200SP IM 155-6 PN HF
  • Siemens SIMATIC ET 200SP IM 155-6 PN/2 HF
  • Siemens SIMATIC ET 200SP IM 155-6 PN/3 HF
  • Siemens SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L
  • Siemens SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L
  • Siemens SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L
  • Siemens SIMATIC ET200ecoPN, DI 16x24VDC, M12-L
  • Siemens SIMATIC ET200ecoPN, DI 8x24VDC, M12-L
  • Siemens SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L
  • Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L
  • Siemens SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L
  • Siemens SIMATIC PN/MF Coupler
  • Siemens SIMATIC PN/PN Coupler
  • Siemens SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
  • Siemens SIMATIC S7-300 CPU 314C-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315F-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 315T-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 317-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 317F-2 PN/DP
  • Siemens SIMATIC S7-300 CPU 317T-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 317TF-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 319-3 PN/DP
  • Siemens SIMATIC S7-300 CPU 319F-3 PN/DP
  • Siemens SIMATIC S7-400 CPU 412-2 PN V7
  • Siemens SIMATIC S7-400 CPU 414-3 PN/DP V7
  • Siemens SIMATIC S7-400 CPU 414F-3 PN/DP V7
  • Siemens SIMATIC S7-400 CPU 416-3 PN/DP V7
  • Siemens SIMATIC S7-400 CPU 416F-3 PN/DP V7
  • Siemens SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants)
  • Siemens SIMATIC TDC CP51M1
  • Siemens SIMATIC TDC CPU555
  • Siemens SIMATIC WinAC RTX 2010
  • Siemens SIMATIC WinAC RTX F 2010
  • Siemens SINAMICS DCM
  • Siemens SINAMICS G110M
  • Siemens SINAMICS G115D

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.