Description
A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint. This could allow an attacker to crash the affected application leading to a denial of service condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | EN100 Ethernet module DNP3 IP variant | All versions | — |
| Siemens | EN100 Ethernet module IEC 104 variant | All versions | — |
| Siemens | EN100 Ethernet module IEC 61850 variant | All versions < V4.37 | — |
| Siemens | EN100 Ethernet module Modbus TCP variant | All versions | — |
| Siemens | EN100 Ethernet module PROFINET IO variant | All versions | — |
Advisories 2
- ICSA-22-167-05 Siemens EN100 Ethernet Module CISA ICS & IT advisories · Jun 14, 2022
- SSA-693555 SSA-693555: Memory Corruption Vulnerability in EN100 Ethernet Module Siemens ProductCERT · Jun 14, 2022