CVE-2023-28766

CVE-2023-28766 is a NULL pointer dereference (CWE-476) affecting Siemens SIPROTEC 5 devices (broad list across CP300, CP100/CP150 variants) due to incomplete validation of HTTP request parameters in the hosted web service. An unauthenticated remote attacker can send crafted HTTP requests to trigg...

CVE-2023-28766

A vulnerability has been identified in SIPROTEC 5 6MD85 CP300 All versions = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 V9.40, SIP...

CVE-2023-28766: NULL Pointer Dereference

A vulnerability has been identified in SIPROTEC 5 6MD85 CP300 All versions = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 V9.40, SIP...

PT-2023-21948 · Siemens · Siprotec 5

Name of the Vulnerable Software and Affected Versions: SIPROTEC 5 6MD85 CP300 versions 7.80 through 9.40 SIPROTEC 5 6MD86 CP300 versions 7.80 through 9.40 SIPROTEC 5 6MD89 CP300 versions 7.80 through 9.64 SIPROTEC 5 6MU85 CP300 versions 7.80 through 9.40 SIPROTEC 5 7KE85 CP300 versions 7.80 throu...

Siemens SIPROTEC 5 代码问题漏洞

Siemens SIPROTEC 5 is a multifunction relay from Siemens, Germany. A code issue vulnerability exists in the Siemens SIPROTEC 5 that stems from a lack of proper validation of the http request parameters of the hosted web service, which can be exploited by an attacker to send specially crafted...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in, among others: TIA Portal, SIPROTEC, SICAM , SCALANCE, SIMANTIC and Mendix. The vulnerabilities potentially enable a malicious party to launch attacks that could result in the following categories of damage: Denial-of-Service DoS. Remote code execution User...

Siemens SIPROTEC 5 Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens RADIUS Client of SIPROTEC 5 Devices

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

Vulnerabilities fixed in Siemens products

Siemens has fixed vulnerabilities in SCALANCE, among others, RuggedCom, SIMATIC, SIPROTEC and Mendix. The vulnerabilities allow a malicious party potentially capable of carrying out attacks that lead to the following categories of damage: Denial-of-Service DoS. Accessing sensitive data Bypassing...

Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays Improper Input Validation (CVE-2018-11451)

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module All versions V4.33, Firmware variant PROFINET IO for EN100 Ethernet module All versions, Firmware variant Modbus TCP for EN100 Ethernet module All versions, Firmware variant DNP3 TCP for EN100 Ethernet...

Siemens SIPROTEC 5 Devices Improper Input Validation (CVE-2021-41769)

A vulnerability has been identified in SIPROTEC 5 6MD85 devices CPU variant CP300 All versions V8.83, SIPROTEC 5 6MD86 devices CPU variant CP300 All versions V8.83, SIPROTEC 5 6MD89 devices CPU variant CP300 All versions V8.83, SIPROTEC 5 6MU85 devices CPU variant CP300 All versions V8.83, SIPROT...

K45062506: Siemens Ethernet card DoS vulnerabilities CVE-2018-11451 and CVE-2018-11452

Security Advisory Description CVE-2018-11451 A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module All versions V4.33, Firmware variant PROFINET IO for EN100 Ethernet module All versions, Firmware variant Modbus TCP for EN100 Ethernet module All versions,...

Siemens SIPROTEC 5 Devices Uncontrolled Resource Consumption (CVE-2022-45044)

Affected devices do not properly restrict secure client-initiated renegotiations within the SSL and TLS protocols. This could allow an attacker to create a denial of service condition on the ports 443/tcp and 4443/tcp for the duration of the attack. This plugin only works with Tenable.ot. Please...

Siemens SIPROTEC 5 Devices Denial of Service Vulnerability

SIPROTEC 5 devices offer a range of integrated protection, control, measurement and automation functions for substations and other applications. A denial of service vulnerability exists in Siemens SIPROTEC 5 Devices, which can be exploited by an attacker to cause a denial of service on ports...

CVE-2022-45044

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V9.50, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V9.50, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V9.50, SIPROTEC 5 6MD89 CP300 All versions V9.64, SIPROTEC 5...

Design/Logic Flaw

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V9.50, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V9.50, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V9.50, SIPROTEC 5 6MD89 CP300 All versions V9.64, SIPROTEC 5...

CVE-2022-45044

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V9.50, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V9.50, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V9.50, SIPROTEC 5 6MD89 CP300 All versions V9.64, SIPROTEC 5...

CVE-2022-45044: Uncontrolled Resource Consumption

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V9.50, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V9.50, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V9.50, SIPROTEC 5 6MD89 CP300 All versions V9.64, SIPROTEC 5...

CVE-2022-45044

CVE-2022-45044 affects Siemens SIPROTEC 5 devices (broad list of models/CP variants) and related modules. The vulnerability is due to insufficient restriction of secure client-initiated SSL/TLS renegotiations, which could allow an attacker to trigger a denial-of-service condition on ports 443/TCP...

PT-2022-27389 · Siemens · Siprotec 5

Name of the Vulnerable Software and Affected Versions: SIPROTEC 5 6MD84 CP300 versions prior to V9.50 SIPROTEC 5 6MD85 CP200 versions SIPROTEC 5 6MD85 CP300 versions prior to V9.50 SIPROTEC 5 6MD86 CP200 versions SIPROTEC 5 6MD86 CP300 versions prior to V9.50 SIPROTEC 5 6MD89 CP300 versions prior...