A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet…
Priority LOW 29Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
Why it matters now
EPSS 0.01155 67th percentileScored 2026-11-07
Fix Fixed Firmware variant IEC 61850 for EN100 Ethernet module (Siemens): V4.35SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (Siemens): V7.82+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | Firmware variant IEC 61850 for EN100 Ethernet module | before V4.35 | V4.35 | Patch available | CNA |
| Siemens | Firmware variant MODBUS TCP for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | Firmware variant DNP3 TCP for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | Firmware variant IEC104 for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | Firmware variant Profinet IO for EN100 Ethernet module | All versions | — | No fix listed | CNA |
| Siemens | SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules | before V7.82 | V7.82 | Patch available | CNA |
| Siemens | SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules | before V7.58 | V7.58 | Patch available | CNA |
- Firmware variant IEC 61850 for EN100 Ethernet module VendorSiemens Affected before V4.35 Fixed in V4.35 Patch available CNA
- Firmware variant MODBUS TCP for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Firmware variant DNP3 TCP for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Firmware variant IEC104 for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- Firmware variant Profinet IO for EN100 Ethernet module VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules VendorSiemens Affected before V7.82 Fixed in V7.82 Patch available CNA
- SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules VendorSiemens Affected before V7.58 Fixed in V7.58 Patch available CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:siprotec_5_with_cpu_variant_cp100:*:*:*:*:*:*:*:* | before 7.82 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:siprotec_5_with_cpu_variant_cp200:*:*:*:*:*:*:*:* | before 7.58 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:siprotec_5_with_cpu_variant_cp300:*:*:*:*:*:*:*:* | before 7.82 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:6md85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:6md86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ke85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sa82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sa86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sa87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sd82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:siprotec_5_with_cpu_variant_cp100:*:*:*:*:*:*:*:* Versions before 7.82 Vulnerable ·Siemens
- cpe:2.3:o:siemens:siprotec_5_with_cpu_variant_cp200:*:*:*:*:*:*:*:* Versions before 7.58 Vulnerable ·Siemens
- cpe:2.3:o:siemens:siprotec_5_with_cpu_variant_cp300:*:*:*:*:*:*:*:* Versions before 7.82 Vulnerable ·Siemens
- cpe:2.3:h:siemens:6md85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:6md86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ke85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sa82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sa86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sa87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sd82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:7sd86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sd87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sj82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sj85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sj86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sk82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sk85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sl82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sl86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7sl87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ss85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7um85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut82:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut85:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut86:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7ut87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:h:siemens:7vk87:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_dnp3_tcp:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec_61850:4.35:*:*:*:*:*:*:* | 4.35 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec104:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_modbus_tcp:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_profinet_io:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:h:siemens:7sd86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sd87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sj82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sj85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sj86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sk82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sk85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sl82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sl86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7sl87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ss85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7um85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut82:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut85:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut86:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7ut87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:h:siemens:7vk87:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_dnp3_tcp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec_61850:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec104:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_modbus_tcp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_profinet_io:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA Firmware variant IEC 61850 for EN100 Ethernet module (Siemens) Fixed in V4.35
- Fix · CNA SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (Siemens) Fixed in V7.82
- Fix · CNA SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (Siemens) Fixed in V7.58
Timeline
- 2026-10-02 Threatist record created from CVE-2018-16563
- 2026-10-03 Alias added: GHSA-72c7-gmhw-rgxw
References
More Siemens En100 Ethernet Module Firmware vulnerabilities
- TI-2016-06113 A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet… CVSS 3.0CRITICAL 9.8
- TI-2016-06115 A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet… CVSS 3.0HIGH 8.8
- TI-2016-06114 A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet… CVSS 3.0HIGH 7.5
Sources
- CVE-2018-16563 · CVE Program
- CVE-2018-16563 · NVD
- FIRST EPSS
- GHSA-72c7-gmhw-rgxw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences