CVE-2024-38867 in SIPROTEC 5 6MD84 CP300
요약
\~에 의해 VulDB • 2026. 08. 03.
Based on the detailed list of affected Siemens SIPROTEC 5 devices and communication modules, here is a structured analysis and recommended mitigation strategy for this vulnerability.
### **Vulnerability Summary** * **Affected Products:** Multiple models within the Siemens SIPROTEC 5 series (7SK85, 7SL82/86/87, 7SS85, 7ST85/86, 7SX82/85, 7UM85, 7UT82/85/86/87, 7VE85, 7VK87, 7VU85) and specific Communication Modules (ETH-BA-2EL Rev.1, ETH-BB-2FO Rev.1, ETH-BD-2FO). * **Affected Firmware Versions:** Various versions below V9.64–V9.65 depending on the device type and CPU platform (CP100/CP150/CP200/CP300/CP050). Notably, some CP200 devices are affected regardless of version for certain modules. * **Root Cause:** Support for weak cryptographic ciphers in TLS implementations on specific ports. * **Impact:** Man-in-the-Middle (MitM) attackers can decrypt sensitive data transmitted over: * `443/tcp` (Web Interface) * `4443/tcp` (DIGSI 5 Configuration Tool) * Configurable syslog port over TLS.
---
### **Recommended Mitigation Steps**
#### **1. Immediate Actions (Short-Term)** * **Network Segmentation:** Ensure that SIPROTEC devices are isolated in a secure industrial DMZ or protected zone with strict firewall rules. Only allow necessary IPs/ports for DIGSI 5 and monitoring systems to access these ports. * **Disable Unnecessary Services:** If syslog over TLS is not required, disable it via the device configuration (using an already authenticated session if possible). Similarly, restrict web interface access if DIGSI 5 is used exclusively. * **Monitor for Anomalies:** Enable logging on network devices to detect unusual traffic patterns or failed SSL/TLS handshakes that might indicate probing attempts.
#### **2. Firmware Update (Primary Remediation)** The most effective fix is upgrading the firmware of all affected devices and communication modules to versions where weak ciphers are disabled. Based on your list, target these minimum versions:
| Device/Module Type | Minimum Safe Version | Notes | |--------------------|----------------------|-------| | **7SK85 (CP300)** | V9.65+ | All previous versions affected | | **7SL82 (CP100)** | V8.90+ | Critical for CP100 platforms | | **7SL82/86/87, 7SX82/85, 7UT82/85/86/87** | V9.65+ | Most common protection relay models | | **7SS85 (CP300), 7ST85/86, 7UM85, 7VE85, 7VU85** | V9.64+ | Metering and station control units | | **ETH-BA-2EL Rev.1 on CP100** | V8.89+ | Communication module specific fix | | **ETH-BB-2FO Rev.1 on CP100** | V8.89+ | Communication module specific fix | | **All ETH Modules (CP150/CP300)** | V9.62+ | Applies to most communication modules except CP100-specific cases above | | **ETH-BA-2EL Rev.1 on CP200** | Any Version | All versions affected; update device firmware if possible or isolate | | **7SX800 (CP050)** | V9.64+ | Compact series |
> **Note:** Always verify the exact version number using Siemens’ official security bulletins or support portal, as patch availability may vary by region and specific hardware revision.
#### **3. Configuration Hardening** * **Enforce Strong Ciphers:** After updating firmware, manually configure TLS settings (if supported) to explicitly allow only strong cipher suites (e.g., AES-GCM, ChaCha20-Poly1305 with SHA-2/SHA-3 hashes). Disable RC4, DES, 3DES, and export-grade ciphers. * **Certificate Validation:** Ensure that DIGSI 5 clients validate server
If you want to get best quality of vulnerability data, you may have to visit VulDB.