A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions), SIPROTEC 5 6MD86 (CP200) (All versions), SIPROTEC 5 6MD86 (CP300) (All versions), SIPROTEC 5 6MD89 (CP300) (All versions), SIPROTEC 5 6MU85 (CP300) (All versions), SIPROTEC 5 7KE85 (CP200) (All versions), SIPROTEC 5 7KE85 (CP300) (All versions), SIPROTEC 5 7SA82 (CP100) (All versions), SIPROTEC 5 7SA82 (CP150) (All versions), SIPROTEC 5 7SA86 (CP200) (All versions), SIPROTEC 5 7SA86 (CP300) (All versions), SIPROTEC 5 7SA87 (CP200) (All versions), SIPROTEC 5 7SA87 (CP300) (All versions), SIPROTEC 5 7SD82 (CP100) (All versions), SIPROTEC 5 7SD82 (CP150) (All versions), SIPROTEC 5 7SD86 (CP200) (All versions), SIPROTEC 5 7SD86 (CP300) (All versions), SIPROTEC 5 7SD87 (CP200) (All versions), SIPROTEC 5 7SD87 (CP300) (All versions), SIPROTEC 5 7SJ81 (CP100) (All versions), SIPROTEC 5 7SJ81 (CP150) (All versions), SIPROTEC 5 7SJ82 (CP100) (All versions), SIPROTEC 5 7SJ82 (CP150) (All versions), SIPROTEC 5 7SJ85 (CP200) (All versions), SIPROTEC 5 7SJ85 (CP300) (All versions), SIPROTEC 5 7SJ86 (CP200) (All versions), SIPROTEC 5 7SJ86 (CP300) (All versions), SIPROTEC 5 7SK82 (CP100) (All versions), SIPROTEC 5 7SK82 (CP150) (All versions), SIPROTEC 5 7SK85 (CP200) (All versions), SIPROTEC 5 7SK85 (CP300) (All versions), SIPROTEC 5 7SL82 (CP100) (All versions), SIPROTEC 5 7SL82 (CP150) (All versions), SIPROTEC 5 7SL86 (CP200) (All versions), SIPROTEC 5 7SL86 (CP300) (All versions), SIPROTEC 5 7SL87 (CP200) (All versions), SIPROTEC 5 7SL87 (CP300) (All versions), SIPROTEC 5 7SS85 (CP200) (All versions), SIPROTEC 5 7SS85 (CP300) (All versions), SIPROTEC 5 7ST85 (CP200) (All versions), SIPROTEC 5 7ST85 (CP300) (All versions), SIPROTEC 5 7ST86 (CP300) (All versions), SIPROTEC 5 7SX82 (CP150) (All versions), SIPROTEC 5 7SX85 (CP300) (All versions), SIPROTEC 5 7SY82 (CP150) (All versions), SIPROTEC 5 7UM85 (CP300) (All versions), SIPROTEC 5 7UT82 (CP100) (All versions), SIPROTEC 5 7UT82 (CP150) (All versions), SIPROTEC 5 7UT85 (CP200) (All versions), SIPROTEC 5 7UT85 (CP300) (All versions), SIPROTEC 5 7UT86 (CP200) (All versions), SIPROTEC 5 7UT86 (CP300) (All versions), SIPROTEC 5 7UT87 (CP200) (All versions), SIPROTEC 5 7UT87 (CP300) (All versions), SIPROTEC 5 7VE85 (CP300) (All versions), SIPROTEC 5 7VK87 (CP200) (All versions), SIPROTEC 5 7VK87 (CP300) (All versions), SIPROTEC 5 7VU85 (CP300) (All versions), SIPROTEC 5 Compact 7SX800 (CP050) (All versions). The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution.
CVE-2025-40808 affects Siemens SIPROTEC 5 protection relays across 60+ device models, allowing authenticated users to upload arbitrary files via DIGSI 5 protocol. This CWE-434 vulnerability could enable denial of service or code execution through malicious configuration files. With no patch currently available and widespread deployment in critical infrastructure, this poses significant risk to Saudi energy and industrial sectors.
Immediate Actions:
1. Inventory all SIPROTEC 5 devices across organization (all 60+ affected models)
2. Restrict DIGSI 5 protocol access to authorized maintenance personnel only
3. Implement network segmentation isolating protection relay networks from general IT
4. Enable detailed logging of all DIGSI 5 upload activities
5. Require multi-factor authentication for DIGSI 5 access
Compensating Controls (until patch available):
6. Deploy file integrity monitoring on relay configuration files
7. Implement strict change management requiring approval before any configuration uploads
8. Use air-gapped maintenance networks for DIGSI 5 operations
9. Validate all configuration files against known-good checksums before deployment
10. Monitor relay CPU/memory usage for anomalous behavior indicating code execution
Detection Rules:
- Alert on DIGSI 5 upload commands from non-standard source IPs
- Flag configuration files with unexpected file extensions or sizes
- Monitor relay event logs for unauthorized configuration changes
- Detect relay reboots following configuration uploads
- Alert on relay process execution anomalies post-upload
الإجراءات الفورية:
1. حصر جميع أجهزة SIPROTEC 5 في المنظمة (جميع الموديلات الـ 60+ المتأثرة)
2. تقييد وصول بروتوكول DIGSI 5 للموظفين المصرحين فقط
3. تطبيق تقسيم الشبكة لعزل شبكات أجهزة الحماية عن تكنولوجيا المعلومات العامة
4. تفعيل تسجيل مفصل لجميع أنشطة تحميل DIGSI 5
5. فرض المصادقة متعددة العوامل لوصول DIGSI 5
الضوابط التعويضية (حتى توفر التصحيح):
6. نشر مراقبة سلامة الملفات على ملفات إعدادات الجهاز
7. تطبيق إدارة تغيير صارمة تتطلب موافقة قبل أي تحميل إعدادات
8. استخدام شبكات صيانة معزولة لعمليات DIGSI 5
9. التحقق من جميع ملفات الإعدادات مقابل بصمات معروفة قبل النشر
10. مراقبة استخدام CPU والذاكرة للجهاز للكشف عن السلوك الشاذ
قواعد الكشف:
- تنبيهات على أوامر تحميل DIGSI 5 من عناوين IP غير قياسية
- وضع علامة على ملفات الإعدادات بامتدادات أو أحجام غير متوقعة
- مراقبة سجلات أحداث الجهاز للتغييرات غير المصرحة
- الكشف عن إعادة تشغيل الجهاز بعد تحميل الإعدادات
- تنبيهات على شذوذ تنفيذ العمليات بعد التحميل