Advisory Summary
Siemens ProductCERT has published security advisory SSA-798801 detailing CVE-2026-79880 (CVSS score 8.8), a network-adjacent vulnerability affecting the PROFINET Discovery and basic Configuration Protocol (DCP) stack within SIMATIC S7-1500 and S7-1200 Programmable Logic Controllers (PLCs).
SIMATIC S7-1500 controllers serve as the automation core for high-reliability manufacturing, automotive assembly lines, power generation plants, and water treatment utilities worldwide. The flaw enables an attacker with local subnet access to modify PLC communication parameters, causing plant-wide denial of service or man-in-the-middle positioning.
Technical Mechanics: Unauthenticated PROFINET DCP 'Set' Commands
PROFINET DCP operates directly over Layer 2 Ethernet (EtherType 0x8892) without IP layer routing. It is primarily used during engineering commissioning to discover unconfigured devices and assign permanent station names, subnet masks, and IP addresses.
| Vulnerability Attribute | Engineering Detail |
|---|---|
| Vulnerability ID | CVE-2026-79880 |
| Common Weakness Enumeration | CWE-306 (Missing Authentication for Critical Function) |
| CVSS v3.1 Base Score | 8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
| Affected Hardware | SIMATIC S7-1500 (all CPU firmware versions < V3.1.2), S7-1200 (< V4.6.2) |
| Remediation Firmware | SIMATIC S7-1500 Firmware V3.1.2 / S7-1200 Firmware V4.6.2 |
Under default configurations, the controller's integrated Ethernet interface accepted broadcast DCP Set (IP-Parameter) and Set (Device-Properties) frames even while operating in active RUN mode. An adversary connected to an unmanaged field switch can transmit a forged DCP frame targeting the PLC's MAC address, instantly changing its IP address to an arbitrary subnet or altering its PROFINET Device Name.
Plant Floor Blast Radius & Safety Impacts
When the PLC's PROFINET station name or IP address is unexpectedly reassigned:
- Decoupling of Remote I/O Racks: Distributed ET 200SP / ET 200MP I/O stations immediately drop their cyclic communication channels (IRT/RT), forcing actuators into fail-safe emergency stop positions.
- Safety Instrumented System (SIS) Trips: Fail-safe F-CPUs (such as S7-1518F) detect communication timeouts across PROFIsafe links, triggering immediate emergency plant shutdowns.
- Network Hijacking & Spoofing: Attackers can assign duplicate IP addresses to engineer workstations or SCADA servers, causing routing table thrashing and blind blind-drop attacks on automation telemetry.
Defensive Engineering Checklist (IEC 62443 Guidelines)
OT security engineers and control system integrators must apply the following hardening measures:
- Deploy Firmware Updates: Flash SIMATIC S7-1500 CPUs with Firmware V3.1.2 or higher, which enforces a mandatory configuration lock rejecting DCP Set requests when the operating switch is in RUN mode.
- Disable DCP Configuration in TIA Portal: In the TIA Portal hardware configuration properties, uncheck the option 'Permit adaptation of IP and PROFINET parameters by DCP' to permanently reject runtime modifications.
- Layer 2 Network Segmentation (IEC 62443-3-3 SL-2): Utilize managed switches (e.g., SCALANCE X-series) with MAC address binding, Port Security, and IEEE 802.1Q VLAN separation to isolate PROFINET traffic from generic plant floor laptops.
- Block EtherType 0x8892 on Routers: Ensure inter-cell industrial routers and firewalls drop all Layer 2 DCP broadcast frames at cell boundaries.
