CVE-2021-37206
High
Description
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP100 (All versions < V8.80), SIPROTEC 5 relays with CPU variants CP300 (All versions < V8.80). Received webpackets are not properly processed. An unauthenticated remote attacker with access to any of the Ethernet interfaces could send specially crafted packets to force a restart of the target device.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSiemens Siprotec 5 With Cpu Variant
PublishedSep 14, 2021
First seenSep 14, 2021
Weakness typeCWE-20Improper input validation
How to fix
Update
- siemens siprotec_5_with_cpu_variant_cp0508.80 or later
- siemens siprotec_5_with_cpu_variant_cp1008.80 or later
- siemens siprotec_5_with_cpu_variant_cp3008.80 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens siprotec_5_with_cpu_variant_cp050 | v < 8.80 | 8.80 |
| siemens siprotec_5_with_cpu_variant_cp100 | v < 8.80 | 8.80 |
| siemens siprotec_5_with_cpu_variant_cp300 | v < 8.80 | 8.80 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.