Description
A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.40), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint manupulating a specific argument. This could allow an attacker to crash the affected application leading to a denial of service condition
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | EN100 Ethernet module DNP3 IP variant | All versions | — |
| Siemens | EN100 Ethernet module IEC 104 variant | All versions | — |
| Siemens | EN100 Ethernet module IEC 61850 variant | All versions < V4.40 | — |
| Siemens | EN100 Ethernet module Modbus TCP variant | All versions | — |
| Siemens | EN100 Ethernet module PROFINET IO variant | All versions | — |
Advisories 2
- ICSA-22-195-16 Siemens EN100 Ethernet Module CISA ICS & IT advisories · Jul 12, 2022
- SSA-865333 SSA-865333: Memory Corruption Vulnerability in EN100 Ethernet Module Siemens ProductCERT · Jul 12, 2022