CVE-2015-5374
HighSummary
A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that could lead to denial-of-service. Specifically crafted packets sent to port 50000/UDP could cause the device to crash.
Risk Assessment
The organization may experience device outages, potentially disrupting industrial processes. Manual intervention may be required to restore device functionality.
Recommendation
It is recommended to update the firmware to at least V1.04.01 for PROFINET IO, V1.11.00 for Modbus TCP, V1.03 for DNP3 TCP, V1.21 for IEC 104, and 1.02.02 for SIPROTEC Merging Unit 6MU80.
Other vulnerabilities in EN100 Ethernet module
See all- CVE-2016-7114High
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
- CVE-2016-7113High
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Versions below specified numbers may be susceptible to an attack that causes the device to enter defect mode upon receiving specially crafted packets on port 80/tcp.
- CVE-2016-7112Critical
A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that are older than specified versions. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
Original NVD description (English source)
A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.