CVE-2015-5374 Public exploit EPSS 74.5%

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions <…

Summary

A vulnerability in the Firmware variants (PROFINET IO, Modbus TCP, DNP3 TCP, and IEC 104) of the EN100 Ethernet module, which is also included in the SIPROTEC Merging Unit 6MU80, allows a denial-of-service condition. An attacker who can send specially crafted packets to UDP port 50000 of an affected device can cause it to stop providing service, and a manual reboot may be needed to restore it.

Official description · CVE.org

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.

Breakdown

65.4 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 1
Tactics: 2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Break in through an internet-facing appT1190 · Exploit Public-Facing ApplicationAI-written (claude-haiku-5-5)Medium confidence149 general detection rules
What they do
- Crash the applicationT1499.004 · Application or System ExploitationAI-written (claude-haiku-5-5)Medium confidence3 general detection rules

First seen exploited 23 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 3 years after disclosure.

Disclosed18 Jul 2015day 0
First seen exploitedVulnCheck KEV evidence12 Jun 2017+23 mo
Public exploit codePoC-in-GitHub14 Feb 2018+3 yrs

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium

AI mapping from the description · how it is exploited

Remote network packets target exposed service directly

Specially crafted packets sent to port 50000/UDP

From the official description (CVE.org) Original ↗

ImpactTA0040

Application or System Exploitation T1499.004 Medium

AI mapping from the description · primary impact

Crafted packets cause device denial of service

could cause a denial-of-service of the affected device

From the official description (CVE.org) Original ↗

Detection

0 rules for this CVE · 152 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-5374 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules

Arcadyan Router Exploitationscriticaltest
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
Citrix Netscaler Attack CVE-2019-19781criticaltest
Confluence Exploitation CVE-2019-3398criticaltest
CVE-2010-5278 Exploitation Attemptcriticaltest
CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest

All 149 on SigmaHQ ↗

Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportweb-assets.esetstatic.com

Reports are matched by finding the exact id CVE-2015-5374 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

web-assets.esetstatic.comUndated

WIN32/INDUSTROYER

…xploit this vulnerability the attackers hardcoded the device IP addresses into this tool Once the tool is executed it sends specifically crafted packets to port 50,000 of the target IP addresses using UDP The UDP packet contains only 18 bytes Figure 20 Content of UDP packet used during exploitation of CVE-2015-5374…

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

CVE Data16 Feb 2026
Industroyer Biggest threat to industrial control systems since Stuxnet6 Dec 2023
Proof Point Emerging Exploit list14 Dec 2022
Industroyer Biggest threat to industrial control systems since Stuxnet12 Jun 2017

References

6 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2015-5330

Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of ServiceEDB-44103 · dos · hardware · 2018-02-16

, 30 Oct 2026

74.5%Top 0.51%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.49%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 3428 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9949 19.9/20

Threat reports1 report 3.9/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module 5.0/5

Mentioned in OTX pulses4 pulses 1.6/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total65.4

Record

Published: 18 Jul 2015
Modified: 17 Sep 2024
: None assigned
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

WIN32/INDUSTROYER

Also mentioned in 4 community threat pulses (AlienVault OTX)

References

x_refsource_CONFIRM 2

exploit 1

x_refsource_MISC 2

vdb-entry 1

How attackers get in

What they do

techniques