SIPROTEC 4 and SIPROTEC Compact with EN100 module may be vulnerable to cyberattacks
Siemens SIPROTEC 4 and SIPROTEC Compact, equipped with EN100 modules with firmware of 4.24 version and lower, are vulnerable to Denial of Service attacks (DoS). Denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet. The attack may be implemented by sending specifically crafted packets to 50000/udp port. If attack is a success, the operation of a relay may be recovered only with the reboot.
To exclude this vulnerability it is required to install EN100 module firmware version of not less than 4.25. Besides that 4.25 firmware version provides a support for GOOSE subscription for a higher number of single points (SPC type) in the same telegram and shows higher stability of operation under frequent ARP broadcast traffic.
Today users may update EN100 module firmware up to 4.26 version. This version is the latest one and provides less recovery times in RSTP rings, built with daisy chain connection of SIPROTEC 4/SIPROTEC Compact and SIPROTEC 5 relays.
To identify current EN100 firmware version, one can specify relay IP-address in the browser (http://ip-address-device/home). To update firmware it is required to open the following page: http://ip-address-device/upload. All the updates and required guidelines are available at official page.