Skip to content
OpenAdvisories
High SSA-203306 2 CVEs

SSA-203306: Password Vulnerabilities in SIPROTEC 4 and SIPROTEC Compact Relay Families

Published Mar 8, 2018 · Updated Jul 13, 2021 · Revision 6

Vendor: Siemens Product: DIGSI 4 Product: EN100 Ethernet module DNP3 variant Product: EN100 Ethernet module IEC 104 variant Product: EN100 Ethernet module IEC 61850 variant Product: EN100 Ethernet module Modbus TCP variant Product: EN100 Ethernet module PROFINET IO variant Product: Other SIPROTEC 4 relays Product: Other SIPROTEC Compact relays Product: SIPROTEC 4 7SD80 Product: SIPROTEC 4 7SJ61 Product: SIPROTEC 4 7SJ62 Product: SIPROTEC 4 7SJ64 Product: SIPROTEC 4 7SJ66 Product: SIPROTEC Compact 7SJ80 Product: SIPROTEC Compact 7SK80

Summary

SIPROTEC 4 and SIPROTEC Compact devices could allow access authorization passwords to be reconstructed or overwritten via engineering mechanisms that involve DIGSI 4 and EN100 Ethernet communication modules.

Siemens has released updates for several affected products, and recommends specific countermeasures for the remaining products.

Vulnerabilities 2

Revision history

  1. #6

    Corrected update version for DNP3

  2. #5

    Added updates for 7SJ61, 7SJ62 and 7SJ64, and recommendation to contact customer care for products without solution

  3. #4

    Added update for 7SD80

  4. #3

    Added update for DNP3 TCP

  5. #1

    Publication Date

  6. #2

    Corrected product name SIPROTEC 4 7SJ66

References