Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays Improper Input Validation (CVE-2018-16563)

medium Tenable OT Security Plugin ID 500102

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial- of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens has released updates for some affected products. Siemens is working on updates for the remaining affected products, and recommends specific countermeasures until fixes are available.

- Firmware variant IEC 61850 for EN100 Ethernet module: Update to v4.35 https://support.industry.siemens.com/cs/us/en/view/109745821
- SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules: Update to firmware version v7.82 for the device types listed in SSA-104088
- SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules: Update to firmware version v7.58 for the device types listed in SSA-104088

The firmware version for the communications modules can also be found on each device’s download page. Applying the update causes the device module to undergo a single restart cycle.

Until updates can be applied, Siemens recommends blocking access to Port 102/TCP with an external firewall.

Siemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before application, and supervision by trained staff of the update process in the target environment.

As a general security measure Siemens strongly recommends protecting network access with appropriate mechanisms (e.g., firewalls, segmentation, VPN). Users are advisded to configure the environment according to Siemens’ operational guidelines in order to run the devices in a protected IT environment.

Siemens recommended security guidelines to secure substations can be found at: https://www.siemens.com/gridsecurity

Additional information on industrial security by Siemens can be found at: https://www.siemens.com/industrialsecurity

For more information on this vulnerability and associated software updates, please see Siemens security advisory SSA-104088 on their website: https://www.siemens.com/cert/advisories

Plugin Details

Severity: Medium

ID: 500102

Version: 1.6

Type: remote

Family: Tenable.ot

Published: 2/7/2022

Updated: 3/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2018-16563

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:siprotec_5_with_cpu_variant_cp100, cpe:/o:siemens:siprotec_5_with_cpu_variant_cp300, cpe:/o:siemens:siprotec_5_with_cpu_variant_cp200, cpe:/o:siemens:en100_ethernet_module_with_firmware_variant_modbus_tcp:-, cpe:/o:siemens:en100_ethernet_module_firmware:-, cpe:/o:siemens:en100_ethernet_module_with_firmware_variant_profinet_io:-, cpe:/o:siemens:en100_ethernet_module_with_firmware_variant_iec104:-, cpe:/o:siemens:en100_ethernet_module_with_firmware_variant_dnp3_tcp:-, cpe:/o:siemens:en100_ethernet_module_with_firmware_variant_iec_61850:4.35

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 3/21/2019

Vulnerability Publication Date: 3/21/2019

Reference Information

CVE: CVE-2018-16563

Detections

Analytics