CVE-2018-16563

mediumpriority · track · 24EPSS 0.012 · 67 %ileEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.16% (67th) EPSS
CVSS 4.3 · medium
Is it mine?
38 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-28

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot

    Update to V4.35 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821. Applying the update causes the module to go through a single restart cycle.

    https://support.industry.siemens.com/cs/us/en/view/109745821.
  • FixedSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernetcisa_csaf_ot

    communication modules Update to firmware version V7.58 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.58". The firmware version V7.58 for the communications modules can also be found on each device specific download page: See in the “Previous Versions” section, article “Protocols”. Applying the update causes the module to go through a single restart cycle.

    https://support.industry.siemens.com/
  • FixedSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respectivecisa_csaf_ot

    Ethernet communication modules Update to firmware version V7.82 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: https://support.industry.siemens.com/ Search for "SIPROTEC 5 - DIGSI Device Drivers V7.8x". The firmware version V7.82 for the communications modules can also be found on each device specific download page: See under "Additional DIGSI Device Driver - V7.8x", article "Protocols". Applying the update causes the module to go through a single restart cycle.

    https://support.industry.siemens.com/
  • MitigationFirmware variant DNP3 TCP for EN100 Ethernet modulecisa_csaf_ot

    See recommendations from section Workaround and Mitigations

  • MitigationFirmware variant IEC 61850 for EN100 Ethernet modulecisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.

  • MitigationFirmware variant IEC104 for EN100 Ethernet modulecisa_csaf_ot

    See recommendations from section Workaround and Mitigations

  • MitigationFirmware variant Modbus TCP for EN100 Ethernet modulecisa_csaf_ot

    See recommendations from section Workaround and Mitigations

  • MitigationFirmware variant PROFINET IO for EN100 Ethernet modulecisa_csaf_ot

    See recommendations from section Workaround and Mitigations

  • MitigationSIPROTEC 5 relays with CPU variants CP200 and the respective Ethernetcisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.

  • MitigationSIPROTEC 5 relays with CPU variants CP300 and CP100 and the respectivecisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–7.5

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v3.05.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 3.6
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.05.4mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20US
04

affected products (38)

Products and version ranges known to be affected.

showing 20 of 38
05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-19-043-02ICSA-19-043-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays2019-02-12icsa · cisa_csaf_otUS

    CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
published 2019-03-21modified 2026-06-17
08

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan