Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
Siemens · SIMATIC CP
The flaw is an improper privilege management weakness in the SNMP service on port 161/udp of Siemens SIMATIC CP 1543-1 and SIPLUS NET CP 1543-1 (affected versions below V2.0.28), which permits writes to SNMP variables that should be read-only and configurable only through TIA-Portal. An attacker with network access and low-privilege credentials, under special conditions, can write these variables to reduce availability or cause a denial-of-service.
A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 5 years after disclosure.
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passages 2Lateral MovementTA0008
Remote network service exploitation via SNMP write
it was possible to write SNMP variables on port 161/udp
ImpactTA0040
Impact is availability reduction and denial of service
could reduce the availability or cause a denial-of-service
Detection
0 rules for this CVE · 18 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2016-8562 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploitation of Remote ServicesT121015 general rules
- Zerologon Exploitation Using Well-known Toolscriticalstable
- Audit CVE Eventcriticaltest
- WannaCry Ransomware Activitycriticaltest
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647highstable
- Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoChightest
- Exploitation Attempt Of CVE-2023-46214 Using Public POC Codehightest
- HackTool - SharpWSUS/WSUSpendu Executionhightest
- Possible Exploitation of Exchange RCE CVE-2021-42321hightest
Application or System ExploitationT1499.0043 general rules
- Audit CVE Eventcriticaltest
- Apache Segmentation Faulthightest
- Nginx Core Dumphightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX