CVE-2016-8562: Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability

CISA Known Exploited Vulnerabilities

Name

Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability

Vendor

Siemens

Product

SIMATIC CP

Added to the catalog

2022-03-03

Due date for US federal agencies

2022-03-24

Weaknesses

CWE-20

Catalog version

2026.10.30

An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.

Required action (CISA)

Apply updates per vendor instructions.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://nvd.nist.gov/vuln/detail/CVE-2016-8562

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2016-11-18T21:59:02.033

Last modified

2026-06-17T00:54:31.297

Weaknesses

NVD-CWE-noinfo

A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.

References

• http://www.securityfocus.com/bid/94436 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-672373.pdf (Broken Link, Patch, Vendor Advisory)
• https://cert-portal.siemens.com/productcert/pdf/ssa-672373.pdf (Vendor Advisory)
• https://ics-cert.us-cert.gov/advisories/ICSA-16-327-01 (Third Party Advisory, US Government Resource)
• http://www.securityfocus.com/bid/94436 (Broken Link, Third Party Advisory, VDB Entry)
• http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-672373.pdf (Broken Link, Patch, Vendor Advisory)
• https://cert-portal.siemens.com/productcert/pdf/ssa-672373.pdf (Vendor Advisory)
• https://ics-cert.us-cert.gov/advisories/ICSA-16-327-01 (Third Party Advisory, US Government Resource)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8562 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:35.381Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2016-8562

CVE record

Assigner

mitre

State

PUBLISHED

Published

2016-11-18T21:00:00.000Z

Updated

2025-10-21T23:55:48.030Z

Problem types

n/a

A vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special conditions it was possible to write SNMP variables on port 161/udp which should be read-only and should only be configured with TIA-Portal. A write to these variables could reduce the availability or cause a denial-of-service.

References

• 94436
• https://ics-cert.us-cert.gov/advisories/ICSA-16-327-01
• http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-672373.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-672373.pdf

Read on 2026-11-03T00:34:11.103Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2016/8xxx/CVE-2016-8562.json