CVE-2023-51440 is a High (7.5) flaw in the TCP/IP stack of Siemens SIMATIC CP 343-1 communication processors. They incorrectly validate TCP sequence numbers, so an unauthenticated remote attacker could cause a denial of service with spoofed reset packets. Siemens plans no fix, so mitigation is network segmentation.
What's affected
Siemens advisory SSA-516818, published 2024-02-13, lists these affected products, all versions:
- SIMATIC CP 343-1 (6GK7343-1EX30-0XE0)
- SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0)
- SIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0)
- SIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0)
For each of them the advisory says that currently no fix is planned. There is no patched version to upgrade to. The advisory gives CVSS v3.1 7.5 and a CVSS v4.0 score of 8.7. The record carries the v3.1 score of 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The record's CISA KEV flag is false.
How to check if you're exposed
There is no version to compare, so exposure is a question of which devices you own and who can reach them. Search your asset inventory and PLC project files for the four order numbers above. In the engineering software, the module catalog shows the CP 343-1 type for each station.
Then map the network paths. For each module, list the hosts that can open TCP connections to it, and ask whether any of those paths cross from an office, vendor or remote access network into the control network. Packet captures at a segment boundary can show whether TCP traffic from unexpected sources reaches the modules.
Because sequence validation is the weakness, an attacker needs a position from which they can send packets that match an existing connection, so network location matters a great deal here.
What to do now
- Inventory every CP 343-1 module, including SIPLUS NET variants.
- Apply network segmentation and defense in depth so that a threat actor cannot easily reach a vulnerable device, which is the countermeasure in the Siemens advisory.
- Follow the Siemens general security recommendations, including the operational guidelines for industrial security.
- Put firewall rules in front of the modules that allow only the specific hosts that need to talk to them.
- Plan for the product lifecycle, since no fix is planned. Add replacement of these modules to your roadmap if reduced exposure is not enough.
Why it matters
The record lists CWE-940 (Improper Verification of Source of a Communication Channel). The advisory states that the products incorrectly validate TCP sequence numbers. A TCP stack should only accept a reset if its sequence number falls inside the expected window. If it accepts others, a forged packet with a plausible source address can tear down a live connection.
The impact is availability only. For a communication processor that links a controller to other equipment, dropped connections can interrupt a process. With no vendor fix planned, the control is architectural: keep untrusted hosts away from these devices.
Quick check
Is there a patch?
No. For all four products Siemens says currently no fix is planned and points to workarounds and mitigations. Check the advisory for updates before you finalize plans.
How do I know which version is fixed?
There is no fixed version. The advisory says all versions are affected and that no fix is currently planned, so follow the network mitigations in SSA-516818.
Sources
Last reviewed: 19 October 2026.
