Skip to main content
Mallory
HighPublic exploit

Denial of Service in Siemens EN100 Ethernet module via UDP port 50000

IdentifiersCVE-2015-5374CWE-400

CVE-2015-5374 is a denial-of-service vulnerability affecting Siemens EN100 Ethernet module firmware variants used in industrial control environments, including PROFINET IO for EN100 Ethernet module (all versions before V1.04.01), Modbus TCP for EN100 Ethernet module (all versions before V1.11.00), DNP3 TCP for EN100 Ethernet module (all versions before V1.03), IEC 104 for EN100 Ethernet module (all versions before V1.21), and the EN100 Ethernet module included in the SIPROTEC Merging Unit 6MU80 (all versions before 1.02.02). According to the provided description, specially crafted packets sent to UDP port 50000 can cause the affected device to enter an unresponsive state. In observed reporting, this issue was associated with Siemens SIPROTEC relay disruption scenarios. Recovery may require a manual reboot of the affected device.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation causes a denial of service on the affected EN100 Ethernet module or associated SIPROTEC device, rendering the device unresponsive and interrupting normal service. In operational technology environments, this can impair communications and availability of protective or control functions until the device is manually recovered. The provided context specifically notes that a manual reboot may be required to restore service.

Mitigation

If you can’t patch tonight, do this now.

Restrict network access to affected devices, especially filtering or blocking untrusted traffic to UDP port 50000. Segment ICS networks to limit exposure of SIPROTEC and EN100-equipped devices, and permit access only from required management or control hosts. Where immediate patching is not possible, deploy network ACLs/firewall rules and monitoring for anomalous traffic targeting UDP/50000, and prepare operational procedures for manual recovery if a device becomes unresponsive.

Remediation

Patch, then assume compromise.

Apply Siemens firmware updates that remediate the issue. The affected versions are: PROFINET IO for EN100 Ethernet module before V1.04.01, Modbus TCP for EN100 Ethernet module before V1.11.00, DNP3 TCP for EN100 Ethernet module before V1.03, IEC 104 for EN100 Ethernet module before V1.21, and EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 before 1.02.02. The content also references Siemens advisory SCA-732541 as the vendor patch/advisory source.
PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app
CVE-2015-5374-DoS-PoCMaturityPoCFrameworkmetasploitVerified exploit

This repository provides two exploit implementations (Python script and Metasploit module) for CVE-2015-5374, a denial of service vulnerability affecting Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Modules with firmware versions below V4.25. The exploit works by sending a specially crafted UDP packet to port 50000 of the target device, causing it to crash and require a manual reboot. The Python script (Siemens_SIPROTEC_DoS.py) is a standalone exploit that takes the target IP as an argument and sends the malicious packet. The Metasploit module (siemens_siprotec4.rb) integrates with the Metasploit Framework, allowing for easier exploitation and automation. Both implementations use the same payload and target the same network vector. The repository is well-structured, with a README.md providing usage instructions, background, and references. No hardcoded IPs or domains are present; the only fingerprintable endpoint is the UDP port 50000 on the target device.

canDisclosed Feb 14, 2018pythonrubynetwork
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
SiemensSiprotec Firmwareoperating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.