CVE-2023-41910 Siemens CVE debrief

Who should care

Industrial control system operators, OT security teams, network administrators managing Siemens SIMATIC/SIPLUS infrastructure, and organizations running lldpd on critical network infrastructure should prioritize this vulnerability. The critical CVSS score, remote exploitability, and presence in industrial communication processors elevate risk for manufacturing, energy, and critical infrastructure environments where these devices are deployed.

Technical summary

The vulnerability resides in the cdp_decode function of lldpd's CDP protocol implementation. A malicious actor can craft a CDP PDU packet with malformed CDP_TLV_ADDRESSES Type-Length-Value structures that cause the daemon to read beyond allocated heap memory boundaries. This is a classic out-of-bounds read vulnerability (CWE-125) in network protocol parsing code. The attack vector is network-based, requires no authentication, and can be exploited remotely. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C confirms critical severity with high impact across all security dimensions. Siemens has addressed this in firmware version 2.3 and later for affected SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, CP 1543SP-1, and SIPLUS ET 200SP variants.

Defensive priority

critical

Recommended defensive actions

• Apply vendor firmware updates to version 2.3 or later for all affected Siemens SIMATIC CP and SIPLUS ET 200SP communication processors
• Disable CDP protocol handling on affected devices if not required for network operations
• Implement network segmentation to restrict LLDP/CDP traffic to trusted management networks
• Monitor for anomalous CDP PDU traffic targeting industrial network infrastructure
• Review and apply CISA ICS recommended practices for defense-in-depth strategies
• Verify lldpd component versions in third-party industrial devices and update to 1.0.17 or later where applicable

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-165-10, which references Siemens Security Advisory SSA-625862. The affected products are SIMATIC CP 1542SP-1, SIMATIC CP 1542SP-1 IRC, SIMATIC CP 1543SP-1, and corresponding SIPLUS variants. The root cause is an out-of-bounds read in lldpd's CDP protocol decoder when processing malformed CDP_TLV_ADDRESSES TLVs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.