CVE-2018-11452
highpriority · track · 31EPSS 0.024 · 84 %ileEURUUSEPSS · scored 2026-10-28
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All versions), Firmware variant Modbus TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions < V1.22). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the EN100 communication module if oscillographs are running. A manual restart is required to recover the EN100 module functionality. Successful exploitation requires an attacker with network access to send multiple packets to the EN100 module. As a precondition the IEC 61850-MMS communication needs to be activated on the affected EN100 modules. No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot
Update to V4.33 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821 - FixedFirmware variant IEC104 for EN100 Ethernet modulecisa_csaf_ot
Update to V1.22 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.
https://support.industry.siemens.com/cs/us/en/view/109745821 - FixedFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot
Update to V4.33. Applying the update causes the module to go through a single restart cycle. - Download: https://support.industry.siemens.com/cs/us/en/view/109745821
https://support.industry.siemens.com/cs/us/en/view/109745821 - MitigationFirmware variant DNP3 TCP for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC104 for EN100 Ethernet modulecisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant Modbus TCP for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationFirmware variant PROFINET IO for EN100 Ethernet modulecisa_csaf_ot
See recommendations from section Workaround and Mitigations
- MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernetcisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respectivecisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.
- MitigationFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/TCP e.g. with an external firewall.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (32)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- ICSA-18-347-02ICSA-18-347-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays (Update A)2018-07-11icsa · cisa_csaf_otUS
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
- ICSA-19-038-02ICSA-19-038-02 Siemens EN100 Ethernet Module2019-01-08icsa · cisa_csaf_otUS
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- http://www.securityfocus.com/bid/106221cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-325546.pdfcnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdfcnnvd
- https://www.securityfocus.com/bid/106221cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-325546.pdfenisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdfenisa_euvd
- https://www.securityfocus.com/bid/106221enisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-325546.pdfMitigationPatchVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan