ICSA-19-043-02

icsaUScisa_csaf_ot

ICSA-19-043-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays

view advisory published 2019-02-12

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2018-16563USmedium5.9—
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versi…
02

references

External citations — patches, advisories, analysis.

03

remediations (10)

  • MitigationFirmware variant DNP3 TCP for EN100 Ethernet module

    See recommendations from section Workaround and Mitigations

  • MitigationFirmware variant IEC 61850 for EN100 Ethernet module

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.

  • MitigationFirmware variant IEC104 for EN100 Ethernet module

    See recommendations from section Workaround and Mitigations

  • MitigationFirmware variant Modbus TCP for EN100 Ethernet module

    See recommendations from section Workaround and Mitigations

  • MitigationFirmware variant PROFINET IO for EN100 Ethernet module

    See recommendations from section Workaround and Mitigations

  • MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.

  • MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.

  • FixedFirmware variant IEC 61850 for EN100 Ethernet module

    Update to V4.35 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821. Applying the update causes the module to go through a single restart cycle.

    https://support.industry.siemens.com/cs/us/en/view/109745821.
  • FixedSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet

    communication modules Update to firmware version V7.58 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.58". The firmware version V7.58 for the communications modules can also be found on each device specific download page: See in the “Previous Versions” section, article “Protocols”. Applying the update causes the module to go through a single restart cycle.

    https://support.industry.siemens.com/
  • FixedSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective

    Ethernet communication modules Update to firmware version V7.82 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.8x". The firmware version V7.82 for the communications modules can also be found on each device specific download page: See under "Additional DIGSI Device Driver - V7.8x", article "Protocols". Applying the update causes the module to go through a single restart cycle.

    https://support.industry.siemens.com/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan