ICSA-19-043-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2018-16563US | medium5.9 | — | ||
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-104088: Denial-of-Service Vulnerabilities in EN100 Ethernet Communication Moduleand SIPROTEC 5 relaysself
- ICS Advisory ICSA-19-043-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-19-043-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (10)
- MitigationFirmware variant DNP3 TCP for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant IEC 61850 for EN100 Ethernet module
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC104 for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant Modbus TCP for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant PROFINET IO for EN100 Ethernet module
See recommendations from section Workaround and Mitigations
- MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- BehobenFirmware variant IEC 61850 for EN100 Ethernet module
Update to V4.35 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821. Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821. - BehobenSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet
communication modules Update to firmware version V7.58 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.58". The firmware version V7.58 for the communications modules can also be found on each device specific download page: See in the Previous Versions section, article Protocols. Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/ - BehobenSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective
Ethernet communication modules Update to firmware version V7.82 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.8x". The firmware version V7.82 for the communications modules can also be found on each device specific download page: See under "Additional DIGSI Device Driver - V7.8x", article "Protocols". Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan