CVE-2024-38867 in SIPROTEC 5 6MD84 CP300
Résumé
par VulDB • 30/06/2026
Based on the detailed list of affected Siemens SIPROTEC 5 devices and communication modules, this is a **critical security vulnerability** related to weak cryptographic configurations (likely involving deprecated or insecure cipher suites such as RC4, DES, or export-grade ciphers) in TLS/SSL implementations.
### ???? Vulnerability Summary - **Affected Products**: Multiple SIPROTEC 5 series devices (7SK85, 7SL82, 7SL86, etc.) and Communication Modules (ETH-BA-2EL, ETH-BB-2FO, ETH-BD-2FO). - **Vulnerable Ports**: - `443/tcp` – Web interface - `4443/tcp` – DIGSI 5 engineering tool connection - Configurable port for Syslog over TLS - **Root Cause**: Support for weak ciphers in SSL/TLS implementations. - **Impact**: An attacker in a man-in-the-middle (MitM) position can decrypt sensitive data, including configuration files, credentials, process values, and control commands.
---
### ????️ Recommended Mitigation Steps
#### 1. **Immediate Actions** - **Isolate Affected Devices**: If possible, isolate vulnerable SIPROTEC devices from untrusted networks until patches are applied. - **Restrict Access**: Ensure that only authorized personnel and systems can access ports 443/tcp, 4443/tcp, and syslog TLS ports via firewall rules or network segmentation.
#### 2. **Apply Firmware Updates** Siemens has released firmware updates to address this issue. Upgrade all affected devices to the following minimum versions: - **V9.65+** for most CP100/CP150/CP300-based devices (e.g., 7SL82, 7SX82, 7UT82, etc.) - **V9.64+** for CP200/CP300 devices like 7SS85, 7ST85, 7VE85, 7VK87, 7VU85 - **V8.90+** for older CP100-based devices (e.g., 7UT82)
> ✅ Verify the current firmware version via DIGSI 5 or device web interface before upgrading.
#### 3. **Disable Weak Ciphers Manually (If Firmware Update Is Not Immediately Possible)** - Access the device configuration via DIGSI 5 or secure CLI. - Navigate to security/TLS settings and disable any weak cipher suites (e.g., RC4, DES, NULL ciphers). - Enforce strong cipher suites such as: ``` TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ```
#### 4. **Monitor for Unauthorized Access** - Enable logging on affected devices and monitor syslog outputs for anomalies. - Use intrusion detection systems (IDS) to detect potential MitM attempts or unusual traffic patterns on ports 443, 4443, and syslog TLS port.
#### 5. **Network Segmentation & Zero Trust Principles** - Place SIPROTEC devices in a dedicated ICS/OT VLAN with strict access control lists (ACLs). - Use mutual authentication where possible for DIGSI 5 connections. - Avoid exposing these ports directly to corporate IT networks or the internet.
#### 6. **Consult Siemens Support** - Refer to [Siemens Security Advisories](https://www.siemens.com/cert) for official patches and guidance.
- Contact your local Siemens support team if you need assistance with firmware upgrades or configuration hardening.
---
### ???? Additional Notes - This vulnerability affects **all versions below the specified thresholds**, so even devices running older stable releases may be at risk. - The use of weak ciphers violates modern security best practices and compliance standards (e.g., NIST SP 800-53, IEC 62443).
---
### ✅ Final Checklist | Action | Status | |-------|--------| | Identify all affected devices in your environment | ☐ | | Apply firmware updates to meet minimum version requirements | ☐ | | Disable weak ciphers manually if update is delayed | ☐ | | Restrict network access to vulnerable ports | ☐ | | Monitor for suspicious activity post-mitigation | ☐ |
By taking these steps, you can significantly reduce the risk of exploitation and ensure secure communication with your SIPROTEC 5 protection relays.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.