CVE-2019-13942

Vulnerability

A buffer overflow vulnerability exists in the webserver of Siemens EN100 Ethernet modules. The affected products include the EN100 Ethernet module for IEC 61850 (versions prior to V4.37), as well as all versions of the EN100 modules for PROFINET IO, Modbus TCP, DNP3, and IEC104. An attacker can trigger the overflow by sending specially crafted packets to the webserver, leading to a denial-of-service condition [1].

Exploitation

An unauthenticated attacker with network access to the affected device can exploit this vulnerability remotely. No authentication or user interaction is required. The attacker sends specially crafted packets to the webserver, causing a buffer overflow. If certain conditions are met, the device must be manually restarted to fully recover [1].

Impact

Successful exploitation results in a denial-of-service condition, rendering the device unresponsive. The CVSS v3 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high availability impact with no confidentiality or integrity impact. At the time of advisory publication, no public exploitation was known [1].

Mitigation

For the EN100 Ethernet module for IEC 61850, updating to version V4.37 or later mitigates the vulnerability. For all other affected variants (PROFINET IO, Modbus TCP, DNP3, IEC104), no fix is currently available; users should contact Siemens for guidance. As a general security measure, restrict network access to the device and monitor for unusual traffic [1].