ICSA-18-347-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays (Update A)
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-11452US | high7.5 | — | ||
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All vers… | ||||
| CVE-2018-11451US | high7.5 | — | ||
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All vers… | ||||
references
External citations — patches, advisories, analysis.
- SSA-635129: Denial-of-Service Vulnerabilities in EN100 Ethernet Communication Moduleand SIPROTEC 5 relaysself
- ICS Advisory ICSA-18-347-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-18-347-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (20)
- MitigationFirmware variant DNP3 TCP for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant DNP3 TCP for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant IEC 61850 for EN100 Ethernet module
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC 61850 for EN100 Ethernet module
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC104 for EN100 Ethernet module
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC104 for EN100 Ethernet module
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant Modbus TCP for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant Modbus TCP for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant PROFINET IO for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant PROFINET IO for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- FixedFirmware variant IEC 61850 for EN100 Ethernet module
Update to V4.33 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821 - FixedFirmware variant IEC 61850 for EN100 Ethernet module
Update to V4.33 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821 - FixedFirmware variant IEC104 for EN100 Ethernet module
Update to V1.22 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821 - FixedFirmware variant IEC104 for EN100 Ethernet module
Update to V1.22 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821 - FixedSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet
Update to firmware version V7.58 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: Search for SIPROTEC 5 <Device type> - DIGSI Device Drivers V7.58 under https:/support.industry.siemens.com/. The firmware version V7.58 for the device can be found under the section Previous Versions. The firmware version V7.58 for the communications modules can also be found on each devices download page. See in the Previous Versions section, article Protocols. Applying the update causes the device / module to go through a single restart cycle.
- FixedSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective
Update to firmware version V7.80 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: Search for "SIPROTEC 5 <Device type> - DIGSI Device Drivers V7.8x" under https://support.industry.siemens.com/. The firmware version V7.80 for the communications modules can also be found on each device specific download page: See under "Additional DIGSI Device Driver - V7.8x", article "Protocols". Applying the update causes the device / module to go through a single restart cycle.
https://support.industry.siemens.com/.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan