CVE-2018-16563
mediumPriorität · verfolgen · 24EPSS 0.012 · 67. PerzentilEURUUSEPSS · bewertet 2026-10-28
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot
Update to V4.35 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821. Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821. - BehobenSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernetcisa_csaf_ot
communication modules Update to firmware version V7.58 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.58". The firmware version V7.58 for the communications modules can also be found on each device specific download page: See in the Previous Versions section, article Protocols. Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/ - BehobenSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respectivecisa_csaf_ot
Ethernet communication modules Update to firmware version V7.82 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.8x". The firmware version V7.82 for the communications modules can also be found on each device specific download page: See under "Additional DIGSI Device Driver - V7.8x", article "Protocols". Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/ - MitigationFirmware variant DNP3 TCP for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC104 for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant Modbus TCP for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant PROFINET IO for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernetcisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respectivecisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.3–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (38)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-19-043-02ICSA-19-043-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays2019-02-12icsa · cisa_csaf_otUS
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.securityfocus.com/bid/107007cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-104088.pdfcnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-19-043-02cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2018-16563cnnvd
- https://support.industry.siemens.com/cs/us/en/view/109745821Patchcnnvd
- https://www.auscert.org.au/bulletins/75470cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-104088.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-104088.pdfVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan