-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

# SSA-974843: Denial-of-Service Vulnerability in SIPROTEC 4 and SIPROTEC Compact Relay
Families

Publication Date:        2020-02-11
Last Update:             2020-02-11
Current Version:         1.0
CVSS v3.1 Base Score:    7.5

SUMMARY
=======

The SIPROTEC 4 and SIPROTEC Compact devices are affected by a security
vulnerability which could allow an attacker to conduct a
Denial-of-Service attack over the network when equipped with EN100
Ethernet communication modules. Siemens recommends specific
countermeasures to mitigate the issue.


AFFECTED PRODUCTS AND SOLUTION
==============================


* SIPROTEC 4 and SIPROTEC Compact relays equipped with EN100 Ethernet
communication modules 
  - Affected versions:
       All versions
  - Remediation:
        See recommendations from section Workaround and Mitigations


WORKAROUNDS AND MITIGATIONS
===========================

Siemens has identified the following specific workarounds and mitigations that
customers can apply to reduce the risk:

* For relays equipped with EN100 Ethernet communication modules having IEC
61850 firmware version V4.30 and higher, activate DTLS-secured
communication in DIGSI 4 and in the EN100 module, and set a connection
password in the EN100 module to permit only authenticated users to
access the relay over the network.
  
* Limit access to port 50000/UDP.
  


GENERAL SECURITY RECOMMENDATIONS
================================

Operators of critical power systems (e.g. TSOs) worldwide are usually
required by regulations to build resilience into the power grids by
applying multi-level redundant secondary protection schemes. It is
therefore recommended that the operators check whether appropriate
resilient protection measures are in place. The risk of cyber incidents
impacting the grid's reliability can thus be minimized by virtue of the
grid design.

Siemens strongly recommends applying the provided security updates using
the corresponding tooling and documented procedures made available with
the product. If supported by the product, an automated means to apply
the security updates across multiple product instances may be used.
Siemens strongly recommends prior validation of any security update
before being applied, and supervision by trained staff of the update
process in the target environment.

As a general security measure Siemens strongly recommends to protect
network access with appropriate mechanisms (e.g. firewalls,
segmentation, VPN). It is advised to configure the environment according
to our operational guidelines in order to run the devices in a protected
IT environment.

Recommended security guidelines to Secure Substations can be found at:

https://www.siemens.com/gridsecurity

PRODUCT DESCRIPTION
===================

SIPROTEC 4 and SIPROTEC Compact devices provide a wide range of
integrated protection, control, measurement, and automation functions
for electrical substations and other fields of application.

VULNERABILITY CLASSIFICATION
============================

The vulnerability classification has been performed by using the CVSS scoring
system in version 3.1 (CVSS v3.1) (https://www.first.org/cvss/). The CVSS 
environmental score is specific to the customer's environment and will impact
the overall CVSS score. The environmental score should therefore be 
individually defined by the customer to accomplish final scoring.

An additional classification has been performed using the CWE classification, a
community-developed list of common software security weaknesses. This serves as
a common language and as a baseline for weakness identification, mitigation,
and prevention efforts. A detailed list of CWE classes can be found at:
https://cwe.mitre.org/.



* Vulnerability CVE-2019-19279

  Specially crafted packets sent to port 50000/UDP of the EN100 Ethernet
  communication modules could cause a Denial-of-Service of the affected
  device. A manual reboot is required to recover the service of the
  device. At the time of advisory publication no public exploitation of
  this security vulnerability was known to Siemens.

  CVSS v3.1 Base Score: 7.5
  CVSS Vector:          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:T/RC:C
  CWE:                  CWE-20: Improper Input Validation


ACKNOWLEDGMENTS
===============

Siemens thanks the following parties for their efforts:

   * Tal Keren from Claroty for coordinated disclosure



ADDITIONAL INFORMATION
======================

For further inquiries on security vulnerabilities in Siemens products and 
solutions, please contact the Siemens ProductCERT:

https://www.siemens.com/cert/advisories


HISTORY DATA
============

V1.0 (2020-02-11): Publication Date

TERMS OF USE
============

Siemens Security Advisories are subject to the terms and conditions contained
in Siemens' underlying license terms or other applicable agreements previously
agreed to with Siemens (hereinafter "License Terms"). To the extent applicable
to information, software or documentation made available in or through a
Siemens Security Advisory, the Terms of Use of Siemens' Global Website
(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in
particular Sections 8-10 of the Terms of Use, shall apply additionally. In case
of conflicts, the License Terms shall prevail over the Terms of Use.
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJeQe6AAAoJENP0geoRSq/kqTMQAI5tpQMu74JrETlWpcSzlFfG
APqYbnec+Y6bVKk1P2NaetiPQDMUAYHa8ZrFlVsFxUy/FLWLzxNN0+TTneJq00J0
MgReidoytnnvc7zE7GD4ztwVrE54yO62VYxHkILzqpVdueldwHHnqkkJORjg0p98
2nb1jqrQiiA1JjL6ycICArMPxmZwA8xZ2607m/sEQ2gaqsWMOdgd9JVaBBMNMWHL
P67CN+apecB3+74Q8vHrQxRqXO0Bcc/GaxCCYhvLoJfH3ufHruvNBI7j22oCKZBE
Y50divP7luO6EO3epZuH5jPrj1EDZ+ct837Pk3qmOhWpD1YyfrVMk+Jc/QPFU4gL
FAAaMT+61zTSXsepj6M5pNsklEmV2JQRqfPXf56TtGCxZGqO3Y09dvJFTVWODJhB
q8sy719W/xBxt26MrLtx9Z4L7d25g7la2IrrAPA0aKn+O9aUz0LP5liauCoA/cUA
mXeSPFZMkGj6EdFCQbs89s68h6OfbYIf71nuDQIixmk15oImFcYPUHME8aeVx7R2
q2bztH6KmJHDZ733ofMlleWnLgRtak3wkWt02l8T54SvihHxvRqjdj5LMO/lk826
SVJ28zWEsTmCiOzcsNAeneMq1SfYJNaA9Ii7OAP1UwpN2Vcvi9MKwA8oXTSH2nY3
JxKcQ8+DMfLp+HOMp5xE
=VUwP
-----END PGP SIGNATURE-----