icsa-18-347-02
Vulnerability from csaf_cisa
Published
2018-07-11 00:00
Modified
2019-02-12 00:00
Summary
ICSA-18-347-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays (Update A)

Notes

Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's TXT advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
General Recommendations
Siemens strongly recommends applying the provided security updates usingthe corresponding tooling and documented procedures made available withthe product. If supported by the product, an automated means to applythe security updates across multiple product instances may be used.
General Recommendations
Siemens strongly recommends prior validation of any security updatebefore being applied, and supervision by trained staff of the updateprocess in the target environment.
General Recommendations
As a general security measure Siemens strongly recommends to protectnetwork access with appropriate mechanisms (e.g. firewalls,segmentation, VPN). It is advised to configure the environment accordingto our operational guidelines in order to run the devices in a protectedIT environment.
General Recommendations
Recommended security guidelines to Secure Substations can be found at:https://www.siemens.com/gridsecurity
Terms of Use
Siemens Security Advisories are subject to the terms and conditions containedin Siemens' underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter "License Terms"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens' Global Website(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.


To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Victor Nikitin",
          "Vladislav Suchkov",
          "Ilya Karpov"
        ],
        "organization": "ScadaX",
        "summary": "coordinating disclosure"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s TXT advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Siemens strongly recommends applying the provided security updates usingthe corresponding tooling and documented procedures made available withthe product. If supported by the product, an automated means to applythe security updates across multiple product instances may be used.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "Siemens strongly recommends prior validation of any security updatebefore being applied, and supervision by trained staff of the updateprocess in the target environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protectnetwork access with appropriate mechanisms (e.g. firewalls,segmentation, VPN). It is advised to configure the environment accordingto our operational guidelines in order to run the devices in a protectedIT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "Recommended security guidelines to Secure Substations can be found at:https://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions containedin Siemens\u0027 underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter \"License Terms\"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website(https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-635129: Denial-of-Service Vulnerabilities in EN100 Ethernet Communication Moduleand SIPROTEC 5 relays",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-635129.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-347-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2018/icsa-18-347-02.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-18-347-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-347-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICSA-18-347-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays (Update A)",
    "tracking": {
      "current_release_date": "2019-02-12T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-18-347-02",
      "initial_release_date": "2018-07-11T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2018-07-11T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2018-12-11T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added update information for SIPROTEC 5 relays with CPU variants CP300, CP200 and CP100 and the respective Ethernet communication modules"
        },
        {
          "date": "2019-02-12T00:00:00.000000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added update information for firmware variant IEC104 for EN100 Ethernet modules"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV4.33",
                "product": {
                  "name": "Firmware variant IEC 61850 for EN100 Ethernet module",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "Firmware variant IEC 61850 for EN100 Ethernet module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Firmware variant PROFINET IO for EN100 Ethernet module",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Firmware variant PROFINET IO for EN100 Ethernet module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Firmware variant Modbus TCP for EN100 Ethernet module",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "Firmware variant Modbus TCP for EN100 Ethernet module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Firmware variant DNP3 TCP for EN100 Ethernet module",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Firmware variant DNP3 TCP for EN100 Ethernet module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.22",
                "product": {
                  "name": "Firmware variant IEC104 for EN100 Ethernet module",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "Firmware variant IEC104 for EN100 Ethernet module"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV7.80",
                "product": {
                  "name": "SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV7.58",
                "product": {
                  "name": "SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-11451",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11451"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.33 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/us/en/view/109745821"
        },
        {
          "category": "mitigation",
          "details": " See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": " See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": " See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.22 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/us/en/view/109745821"
        },
        {
          "category": "vendor_fix",
          "details": "Update to firmware version V7.80 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: Search for \"SIPROTEC 5 \u003cDevice type\u003e - DIGSI Device Drivers V7.8x\" under https://support.industry.siemens.com/. The firmware version V7.80 for the communications modules can also be found on each device specific download page: See under \"Additional DIGSI Device Driver - V7.8x\", article \"Protocols\". Applying the update causes the device / module to go through a single restart cycle.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/."
        },
        {
          "category": "vendor_fix",
          "details": "Update to firmware version V7.58 for the following device types: 6MD85, 6MD86, 7SS85, 7KE85, 7UM85, 7SA87, 7SD87, 7SL87, 7VK87, 7SA82, 7SA86, 7SD82, 7SD86, 7SL82, 7SL86, 7SJ86, 7SK82, 7SK85, 7SJ82, 7SJ85, 7UT82, 7UT85, 7UT86, and 7UT87. - Download: Search for \u0093SIPROTEC 5 \u003cDevice type\u003e - DIGSI Device Drivers V7.58\u0094 under https:/support.industry.siemens.com/. The firmware version V7.58 for the device can be found under the section \u0093Previous Versions.\u0094 The firmware version V7.58 for the communications modules can also be found on each device\u0092s download page. See in the \u0093Previous Versions\u0094 section, article \u0093Protocols\u0094. Applying the update causes the device / module to go through a single restart cycle.",
          "product_ids": [
            "CSAFPID-0007"
          ]
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2018-11452",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the EN100 communication module if oscillographs are running. A manual restart is required to recover the EN100 module functionality. Successful exploitation requires an attacker with network access to send multiple packets to the EN100 module. As a precondition the IEC 61850-MMS communication needs to be activated on the affected EN100 modules. No user interaction or privileges are required to exploit the security vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11452"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V4.33 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/us/en/view/109745821"
        },
        {
          "category": "mitigation",
          "details": " See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": " See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": " See recommendations from section Workaround and Mitigations",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.22 - Download: https://support.industry.siemens.com/cs/us/en/view/109745821 Applying the update causes the module to go through a single restart cycle.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/us/en/view/109745821"
        },
        {
          "category": "mitigation",
          "details": "Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Block access to port 102/tcp e.g. with an external firewall.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.