Read the docs
TI-2022-12998 Aliases CVE-2022-30938GHSA-93f5-xcv7-w96r

Memory corruption in Siemens EN100 Ethernet module DNP3 IP variant

Priority LOW 36CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.40), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint manupulating a specific argument. This could allow an attacker to crash the affected application leading to a denial of service condition

Why it matters now

EPSS 0.01337 71st percentileScored 2026-11-07
Fix Fixed EN100 Ethernet module IEC 61850 variant (Siemens): V4.40

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensEN100 Ethernet module DNP3 IP variantAll versions—No fix listedCNA
SiemensEN100 Ethernet module IEC 104 variantAll versions—No fix listedCNA
SiemensEN100 Ethernet module IEC 61850 variantbefore V4.40V4.40Patch availableCNA
SiemensEN100 Ethernet module Modbus TCP variantAll versions—No fix listedCNA
SiemensEN100 Ethernet module PROFINET IO variantAll versions—No fix listedCNA
  • EN100 Ethernet module DNP3 IP variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • EN100 Ethernet module IEC 104 variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • EN100 Ethernet module IEC 61850 variant VendorSiemens Affected before V4.40 Fixed in V4.40 Patch available CNA
  • EN100 Ethernet module Modbus TCP variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
  • EN100 Ethernet module PROFINET IO variant VendorSiemens Affected All versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:siemens:en100_ethernet_module_dnp3_ip_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:*before 4.40VulnerableSiemens
cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:*:*:*:*:*:*:*:*all versionsVulnerableSiemens
cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSiemens
  • cpe:2.3:o:siemens:en100_ethernet_module_dnp3_ip_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:* Versions before 4.40 Vulnerable ·Siemens
  • cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
  • cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens

Remediation

  • Fix · CNA EN100 Ethernet module IEC 61850 variant (Siemens) Fixed in V4.40

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30938
  2. 2026-10-03 Alias added: GHSA-93f5-xcv7-w96r

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences