Improper input validation in Siemens Firmware variant IEC 61850 for EN100 Ethernet module
Priority LOW 37CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All versions), Firmware variant Modbus TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions < V1.22), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.80), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Why it matters now
EPSS 0.02389 84th percentileScored 2026-11-07
Fix Fixed Firmware variant IEC 61850 for EN100 Ethernet module (Siemens AG): V4.33Firmware variant IEC104 for EN100 Ethernet module (Siemens AG): V1.22+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Firmware variant IEC 61850 for EN100 Ethernet module | before V4.33 | V4.33 | Patch available | CNA |
| Siemens | Firmware variant PROFINET IO for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | Firmware variant Modbus TCP for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | Firmware variant DNP3 TCP for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | Firmware variant IEC104 for EN100 Ethernet module | before V1.22 | V1.22 | Patch available | CNA |
| Siemens | SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules | before V7.80 | V7.80 | Patch available | CNA |
| Siemens | SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules | before V7.58 | V7.58 | Patch available | CNA |
- Firmware variant IEC 61850 for EN100 Ethernet module VendorSiemens Affected before V4.33 Fixed in V4.33 Patch available CNA
- Firmware variant PROFINET IO for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Firmware variant Modbus TCP for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Firmware variant DNP3 TCP for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Firmware variant IEC104 for EN100 Ethernet module VendorSiemens Affected before V1.22 Fixed in V1.22 Patch available CNA
- SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules VendorSiemens Affected before V7.80 Fixed in V7.80 Patch available CNA
- SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules VendorSiemens Affected before V7.58 Fixed in V7.58 Patch available CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:dnp3_tcp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:iec_61850_firmware:*:*:*:*:*:*:*:* | before 4.33 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:iec104_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:modbus_tcp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:profinet_io_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:en100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:cp100_firmware:*:*:*:*:*:*:*:* | before 7.80 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:cp200_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:cp300_firmware:*:*:*:*:*:*:*:* | before 7.80 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:6md85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:dnp3_tcp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:iec_61850_firmware:*:*:*:*:*:*:*:* Versions before 4.33 Vulnerable ·Siemens
- cpe:2.3:o:siemens:iec104_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:modbus_tcp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:profinet_io_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:en100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:cp100_firmware:*:*:*:*:*:*:*:* Versions before 7.80 Vulnerable ·Siemens
- cpe:2.3:o:siemens:cp200_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:cp300_firmware:*:*:*:*:*:*:*:* Versions before 7.80 Vulnerable ·Siemens
- cpe:2.3:h:siemens:6md85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:6md86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ke85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sa82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sa86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sa87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sd82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sd86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sd87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sj82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sj85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sj86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sk82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sk85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sl82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sl86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sl87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ss85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7um85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7vk87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:h:siemens:6md86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ke85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sa82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sa86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sa87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sd82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sd86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sd87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sj82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sj85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sj86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sk82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sk85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sl82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sl86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sl87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ss85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7um85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7vk87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA Firmware variant IEC 61850 for EN100 Ethernet module (Siemens AG) Fixed in V4.33
- Fix · CNA Firmware variant IEC104 for EN100 Ethernet module (Siemens AG) Fixed in V1.22
- Fix · CNA SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (Siemens AG) Fixed in V7.80
- Fix · CNA SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (Siemens AG) Fixed in V7.58
Timeline
- 2026-10-02 Threatist record created from CVE-2018-11451
- 2026-10-03 Alias added: GHSA-c4jw-7vf9-j54c
References
More Siemens Cp100 Firmware vulnerabilities
- TI-2018-08177 Improper input validation in Siemens Firmware variant IEC 61850 for EN100 Ethernet module CVSS 3.0HIGH 7.5
Sources
- CVE-2018-11451 · CVE Program
- CVE-2018-11451 · NVD
- FIRST EPSS
- GHSA-c4jw-7vf9-j54c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences