Skip to content
Fencer Intel
high 7.5

CVE-2018-11451 json

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFIN…

published 2018-07-23 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-3482

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All versions), Firmware variant Modbus TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions < V1.22), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.80), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Patch / fix

  • siemens iec_61850_firmware 4.33
  • siemens cp100_firmware 7.80
  • siemens cp300_firmware 7.80

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-18-347-02 updated cvss 7.5

ICSA-18-347-02 Siemens EN100 Ethernet Communication Module and SIPROTEC 5 Relays (Update A)

  • Siemens Firmware variant DNP3 TCP for EN100 Ethernet module
    affected: mitigation
  • Siemens Firmware variant IEC 61850 for EN100 Ethernet module <V4.33
    affected: fixed in V4.33, mitigation support.industry.siemens.com
  • Siemens Firmware variant IEC104 for EN100 Ethernet module <V1.22
    affected: fixed in V1.22, mitigation support.industry.siemens.com
  • Siemens Firmware variant Modbus TCP for EN100 Ethernet module Siemens Firmware variant PROFINET IO for EN100 Ethernet module
    affected: mitigation
  • Siemens SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet <V7.58
    affected: vendor fix, mitigation
  • Siemens SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective <V7.80
    affected: vendor fix, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-19-038-02 updated cvss 7.5

ICSA-19-038-02 Siemens EN100 Ethernet Module

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.39% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Siemens AG Firmware variant IEC 61850 for EN100 Ethernet module
  • Siemens AG Firmware variant PROFINET IO for EN100 Ethernet module
  • Siemens AG Firmware variant Modbus TCP for EN100 Ethernet module
  • Siemens AG Firmware variant DNP3 TCP for EN100 Ethernet module
  • Siemens AG Firmware variant IEC104 for EN100 Ethernet module
  • Siemens AG SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules
  • Siemens AG SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.