5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
40.2%
CVSS v3 7.5
**ATTENTION:**Exploitable remotely/low skill level to exploit
**Vendor:**Siemens
Equipment: SIPROTEC 4, SIPROTEC Compact, and Reyrolle devices using the EN100 Ethernet communication module extension
Vulnerability: Missing Authentication for Critical Function
This updated advisory is a follow-up to the updated advisory titled ICSA-18-067-02 Siemens SIPROTEC 4, SIPROTEC Compact, and Reyrolle devices using the EN100 Ethernet communication module extension (Update A) that was published April 19, 2018, on the NCCIC/ICS-CERT website.
Successful exploitation of this vulnerability could allow an attacker to either upgrade or downgrade the firmware of the device, including downgrading to older versions with known vulnerabilities.
Siemens reports that the vulnerability affects the following EN100 Ethernet module products:
--------- Begin Update B Part 1 of 2 ---------
--------- End Update B Part 1 of 2 ---------
Successful exploitation of this vulnerability could allow an attacker to either upgrade or downgrade the firmware of the device, including downgrading to older versions with known vulnerabilities.
CVE-2018-4838 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)).
Ilya Karpov and Dmitry Sklyarov from Positive Technologies reported this vulnerability to Siemens.
Siemens has provided the following updates for mitigations:
--------- Begin Update B Part 2 of 2 ---------
--------- End Update B Part 2 of 2 ---------
For all other affected products, Siemens has identified the following specific workarounds and mitigations that users can apply to reduce the risk. As a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g., firewalls, segmentation, VPN). It is advised to configure the environment according to Siemensβ operational guidelines in order to run the devices in a protected IT environment.
Recommended security guidelines to Secure Substations and Defense-in-Depth can be found at: <https://www.siemens.com/gridsecurity>
For further inquiries on vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: <https://www.siemens.com/cert/advisories>
For more information on this vulnerability and associated software updates, please see Siemens security notification SSA-845879 on their website: <https://cert-portal.siemens.com/productcert/pdf/ssa-845879.pdf>
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the NCCIC Technical Information Paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT website.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
No known public exploits specifically target this vulnerability.
cert-portal.siemens.com/productcert/pdf/ssa-845879.pdf
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4838
cwe.mitre.org/data/definitions/306.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
support.industry.siemens.com/cs/document/109745821
support.industry.siemens.com/cs/us/en/ view/109745821
support.industry.siemens.com/cs/us/en/view/109745821
twitter.com/CISAgov
twitter.com/intent/tweet?text=Siemens%20SIPROTEC%204%2C%20SIPROTEC%20Compact%2C%20and%20Reyrolle%20Devices%20using%20the%20EN100%20Ethernet%20Communication%20Module%20Extension%20%28Update%20B%29+https://www.cisa.gov/news-events/ics-advisories/icsa-18-067-02
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-18-067-02&title=Siemens%20SIPROTEC%204%2C%20SIPROTEC%20Compact%2C%20and%20Reyrolle%20Devices%20using%20the%20EN100%20Ethernet%20Communication%20Module%20Extension%20%28Update%20B%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-18-067-02
www.oig.dhs.gov/
www.siemens.com/cert/advisories
www.siemens.com/gridsecurity
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-18-067-02
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Siemens%20SIPROTEC%204%2C%20SIPROTEC%20Compact%2C%20and%20Reyrolle%20Devices%20using%20the%20EN100%20Ethernet%20Communication%20Module%20Extension%20%28Update%20B%29&body=www.cisa.gov/news-events/ics-advisories/icsa-18-067-02
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
40.2%