CVE-2022-30937
📋 TL;DR
A memory corruption vulnerability in Siemens EN100 Ethernet modules allows attackers to cause denial of service by sending specially crafted HTTP packets to the /txtrace endpoint. This affects multiple protocol variants (DNP3, IEC 104, IEC 61850, Modbus TCP, PROFINET IO) across industrial control systems. Organizations using these modules in critical infrastructure are at risk.
💻 Affected Systems
- EN100 Ethernet module DNP3 IP variant
- EN100 Ethernet module IEC 104 variant
- EN100 Ethernet module IEC 61850 variant
- EN100 Ethernet module Modbus TCP variant
- EN100 Ethernet module PROFINET IO variant
📦 What is this software?
En100 Ethernet Module Dnp3 Firmware by Siemens
View all CVEs affecting En100 Ethernet Module Dnp3 Firmware →
En100 Ethernet Module Iec 104 Firmware by Siemens
View all CVEs affecting En100 Ethernet Module Iec 104 Firmware →
En100 Ethernet Module Iec 61850 Firmware by Siemens
View all CVEs affecting En100 Ethernet Module Iec 61850 Firmware →
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash leading to extended downtime of industrial processes, potentially causing safety incidents or production losses in critical infrastructure.
Likely Case
Temporary denial of service requiring device reboot, disrupting industrial operations until service is restored.
If Mitigated
Minimal impact if devices are behind firewalls with restricted HTTP access and proper network segmentation.
🎯 Exploit Status
Exploitation requires sending crafted HTTP packets to /txtrace endpoint, which is relatively simple for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V4.37 for IEC 61850 variant; other variants require firmware updates as per Siemens advisory
Vendor Advisory: https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf
Restart Required: Yes
Instructions:
1. Download firmware updates from Siemens Industrial Security. 2. Follow Siemens EN100 update procedures. 3. Apply firmware to affected devices. 4. Reboot devices after update. 5. Verify version after update.
🔧 Temporary Workarounds
Block HTTP access to /txtrace endpoint
linuxConfigure firewalls or network ACLs to block HTTP traffic to port 80/TCP on EN100 modules, specifically targeting /txtrace path.
iptables -A INPUT -p tcp --dport 80 -m string --string "GET /txtrace" --algo bm -j DROP
Disable HTTP service if not required
allDisable HTTP service on EN100 modules through configuration interface if HTTP functionality is not needed for operations.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate EN100 modules from untrusted networks
- Deploy intrusion detection systems to monitor for HTTP traffic patterns targeting /txtrace endpoint
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or serial console. For IEC 61850 variant, versions < V4.37 are vulnerable. For other variants, all versions are vulnerable.Check Version:
Check via web interface at http://<device_ip>/ or serial console using appropriate vendor commandsVerify Fix Applied:
Verify firmware version is updated to V4.37 or later for IEC 61850 variant, or latest firmware for other variants as per Siemens advisory.📡 Detection & Monitoring
Log Indicators:
- HTTP 400/500 errors from /txtrace endpoint
- Device reboot logs without normal shutdown
- Increased memory usage before crash
Network Indicators:
- HTTP GET requests to /txtrace endpoint with unusual payloads
- Sudden cessation of normal device communications
SIEM Query:
source="firewall" dest_port=80 AND (uri_path="/txtrace" OR http_method="GET" AND uri CONTAINS "txtrace")