{"id":"CVE-2015-5374","published":"2015-07-18T10:00:00Z","modified":"2024-09-17T02:15:53Z","title":"A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions <…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.","provenance":"source","from":"CVE.org"},"summary":{"text":"A vulnerability in the Firmware variants (PROFINET IO, Modbus TCP, DNP3 TCP, and IEC 104) of the EN100 Ethernet module, which is also included in the SIPROTEC Merging Unit 6MU80, allows a denial-of-service condition. An attacker who can send specially crafted packets to UDP port 50000 of an affected device can cause it to stop providing service, and a manual reboot may be needed to restore it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:44Z"},"cvss":null,"epss":{"score":0.74497,"percentile":0.99493,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2017-06-12","exploitedFirstSeen":"2017-06-12","ransomware":false,"evidence":[{"url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf","date":"2017-06-12"},{"url":"https://www.dragos.com/wp-content/uploads/CrashOverride-01.pdf","date":"2017-06-13"},{"url":"https://www.midnightblue.nl/blog/have-you-tried-turning-it-off-and-on-again-part-1","date":"2026-02-11"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"Industroyer Biggest threat to industrial control systems since Stuxnet","url":"https://otx.alienvault.com/pulse/65707a3b083457d721ac2004","created":"2023-12-06"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"},{"name":"Industroyer Biggest threat to industrial control systems since Stuxnet","url":"https://otx.alienvault.com/pulse/593e8eb2cffc2a190564f2e1","created":"2017-06-12"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf","tags":["x_refsource_CONFIRM"]},{"url":"http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-732541.pdf","tags":["x_refsource_CONFIRM"]},{"url":"https://www.exploit-db.com/exploits/44103/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01","tags":["x_refsource_MISC"]},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/75948","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote network packets target exposed service directly","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Specially crafted packets sent to port 50000/UDP","start":441,"end":489}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Crafted packets cause device denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"could cause a denial-of-service of the affected device","start":490,"end":544}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-76f5249e70ce878e3b73","title":"WIN32/INDUSTROYER","publisher":"web-assets.esetstatic.com","url":"https://web-assets.esetstatic.com/wls/2017/06/Win32_Industroyer.pdf","date":null,"mentions":[{"quote":"the CVE-2015-5374 vulnerability in order to render a device unresponsive","start":27988,"end":28060},{"quote":"xploit this vulnerability the attackers hardcoded the device IP addresses\r\ninto this tool Once the tool is executed it sends specifically crafted packets\r\nto port 50,000 of the target IP addresses using UDP The UDP packet\r\ncontains only 18 bytes\r\nFigure 20 Content of UDP packet used during exploitation of CVE-2015-5374","start":28200,"end":28520}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-5330","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-5330","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":44103,"url":"https://www.exploit-db.com/exploits/44103","title":"Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service","type":"dos","platform":"hardware","date":"2018-02-16","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-02-16"},"pocGithub":{"count":1,"skipped":0,"earliest":"2018-02-14","earliestUrl":"https://github.com/can/CVE-2015-5374-DoS-PoC","repos":[{"name":"can/CVE-2015-5374-DoS-PoC","url":"https://github.com/can/CVE-2015-5374-DoS-PoC","stars":3,"created":"2018-02-14"}]},"metasploit":[{"name":"Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module - Denial of Service","module":"auxiliary/dos/scada/siemens_siprotec4","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/scada/siemens_siprotec4.rb"}],"first":{"date":"2018-02-14","source":"PoC-in-GitHub","url":"https://github.com/can/CVE-2015-5374-DoS-PoC"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/44103/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2015-07-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2015-5374","provenance":"source"},{"date":"2017-06-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf","provenance":"source"},{"date":"2018-02-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2018-02-16","url":"https://github.com/can/CVE-2015-5374-DoS-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":942,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3426 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.9,"detail":"percentile 0.9949"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}