CVE-2022-30937

highpriority · track · 30EPSS 0.013 · 70 %ileDEEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.27% (70th) EPSS
CVSS 7.8 · high
Is it mine?
25 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint. This could allow an attacker to crash the affected application leading to a denial of service condition.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedEN100 Ethernet module IEC 61850 variantsiemens_psirt

    Update to V4.37 or later version

    https://support.industry.siemens.com/cs/us/en/view/109745821/
  • FixedEN100 Ethernet module IEC 61850 variantcisa_csaf_ot

    Update to V4.37 or later version

    https://support.industry.siemens.com/cs/us/en/view/109745821/
  • MitigationEN100 Ethernet module DNP3 IP variantsiemens_psirt

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module IEC 104 variantsiemens_psirt

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module IEC 61850 variantsiemens_psirt

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module Modbus TCP variantsiemens_psirt

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module PROFINET IO variantsiemens_psirt

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module DNP3 IP variantcisa_csaf_ot

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module IEC 104 variantcisa_csaf_ot

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module IEC 61850 variantcisa_csaf_ot

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module Modbus TCP variantcisa_csaf_ot

    Disable web service within the device configuration if it is not used

  • MitigationEN100 Ethernet module PROFINET IO variantcisa_csaf_ot

    Disable web service within the device configuration if it is not used

  • WorkaroundEN100 Ethernet module DNP3 IP variantsiemens_psirt

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module IEC 104 variantsiemens_psirt

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module IEC 61850 variantsiemens_psirt

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module Modbus TCP variantsiemens_psirt

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module PROFINET IO variantsiemens_psirt

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module DNP3 IP variantcisa_csaf_ot

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module IEC 104 variantcisa_csaf_ot

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module IEC 61850 variantcisa_csaf_ot

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module Modbus TCP variantcisa_csaf_ot

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • WorkaroundEN100 Ethernet module PROFINET IO variantcisa_csaf_ot

    Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions

  • No fix plannedEN100 Ethernet module DNP3 IP variantsiemens_psirt

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module IEC 104 variantsiemens_psirt

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module Modbus TCP variantsiemens_psirt

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module PROFINET IO variantsiemens_psirt

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module DNP3 IP variantcisa_csaf_ot

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module IEC 104 variantcisa_csaf_ot

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module Modbus TCP variantcisa_csaf_ot

    Currently no fix is planned

  • No fix plannedEN100 Ethernet module PROFINET IO variantcisa_csaf_ot

    Currently no fix is planned

02

cvss

Technical severity, 0–10. One row per scoring source.

8.6
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–8.6

v2.07.8highAV:N/AC:L/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USexploitability 10 · impact 6.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-119USCWE-119USCWE-119US
04

affected products (25)

Products and version ranges known to be affected.

showing 20 of 25
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SSA-693555SSA-693555: Memory Corruption Vulnerability in EN100 Ethernet Module2022-06-14csaf · siemens_psirtDE

    EN100 Ethernet module is affected by memory corruption vulnerability (CVE-2022-30937). Siemens has released an update for the EN100 Ethernet module IEC 61850 variant and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

  • ICSA-22-167-05Siemens EN100 Ethernet Module2022-06-14icsa · cisa_csaf_otUS

    EN100 Ethernet module is affected by memory corruption vulnerability (CVE-2022-30937). Siemens has released an update for the EN100 Ethernet module IEC 61850 variant and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
published 2022-06-14modified 2026-06-17
09

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan