Skip to content
Fencer Vulns
medium 5.9

CVE-2018-16563 json

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS…

published 2019-03-21 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-8370

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Patch / fix

  • siemens siprotec_5_with_cpu_variant_cp100 7.82
  • siemens siprotec_5_with_cpu_variant_cp200 7.58
  • siemens siprotec_5_with_cpu_variant_cp300 7.82

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-043-02 updated cvss 7.5

ICSA-19-043-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays

  • Siemens Firmware variant DNP3 TCP for EN100 Ethernet module
    affected: mitigation
  • Siemens Firmware variant IEC 61850 for EN100 Ethernet module <V4.35
    affected: fixed in V4.35, mitigation support.industry.siemens.com
  • Siemens Firmware variant IEC104 for EN100 Ethernet module Siemens Firmware variant MODBUS TCP for EN100 Ethernet module Siemens Firmware variant Profinet IO for EN100 Ethernet module
    affected: mitigation
  • Siemens SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet <V7.58 Siemens SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective <V7.82
    affected: vendor fix, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

  • Siemens Firmware variant IEC 61850 for EN100 Ethernet module
  • Siemens Firmware variant MODBUS TCP for EN100 Ethernet module
  • Siemens Firmware variant DNP3 TCP for EN100 Ethernet module
  • Siemens Firmware variant IEC104 for EN100 Ethernet module
  • Siemens Firmware variant Profinet IO for EN100 Ethernet module
  • Siemens SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules
  • Siemens SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.