What is the CVSS score of CVE-2015-5374?

CVE-2015-5374 has a CVSS 2.0 base score of 7.8 (High). CVSS vector: AV:N/AC:L/Au:N/C:N/I:N/A:C. EPSS exploitation probability: 84.7%.

Is there a public PoC exploit available for CVE-2015-5374?

Yes, a public proof-of-concept exploit is available for CVE-2015-5374. Prioritise patching immediately. EPSS: 84.7%.

How to fix or mitigate CVE-2015-5374?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Vendor patch is available.

Siprotec Firmware CVE-2015-5374

Q: Which versions of Siprotec Firmware are affected by CVE-2015-5374?

Organizations using A vulnerability face notable risk from CVE-2015-5374 rated CVSS 7.8. Exploitation could compromise the security of affected deployments.. A patch is available.

HIGH

Data Processing Errors (CWE-19)

2015-07-18 cve@mitre.org

Information Disclosure Siemens Siprotec Firmware

7.8

CVSS 2.0 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-19 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory
Impact	CVSS 7.8, EPSS 84.7%, PoC available, patch available. SIPROTEC relays protect critical electrical infrastructure including high-voltage transmission lines and transformer stations. A DoS attack on protection relays could prevent automatic fault clearing, potentially causing cascading power failures or equipment damage during grid faults.
Exploit ScenarioDerived	An attacker with network access to a substation's OT network sends crafted packets to EN100 modules on multiple SIPROTEC relays simultaneously. All targeted protection relays become unresponsive. If a fault occurs on the protected transmission line during the outage, the relays cannot trip the circuit breakers, potentially causing transformer damage or a wider grid cascade.

Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.

Patch available 84.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Siemens EN100 Ethernet module firmware across multiple protocol variants (PROFINET IO, Modbus TCP, DNP3 TCP, IEC 104) contains a vulnerability that allows remote attackers to cause a denial-of-service condition by sending specially crafted packets. The affected module crashes and requires a manual cold restart to recover, impacting industrial control system availability.

Earlier versions of this analysis (1)

v1 Mar 26, 2026 - 11:18 CVSS 7.8

DoS vulnerability in Siemens EN100 Ethernet module firmware affects multiple ICS protocol variants, requiring cold restart for recovery.

RemediationAI

Update EN100 firmware to the patched versions. Implement network segmentation isolating protection relay networks from corporate IT. Deploy IDS rules monitoring for malformed packets targeting EN100 modules. Maintain documented procedures for emergency cold restart of protection relays.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The EN100 Ethernet module provides network connectivity for Siemens SIPROTEC protection relays used in electrical substations. Specially crafted packets sent to the module trigger a crash condition across all protocol variants (PROFINET IO, Modbus TCP, DNP3, IEC 104). The device cannot recover automatically and requires a manual power cycle, which in substation environments means physical access to the relay.

Know when Siprotec Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.8 HIGH

AV:N/AC:L/Au:N/C:N/I:N/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

PoC Detected

Apr 12, 2025 - 10:46 vuln.today

Public exploit code

Patch released

Apr 12, 2025 - 10:46 nvd

Patch available

CVE Published

Jul 18, 2015 - 10:59 nvd

HIGH 7.8

DescriptionCVE.org

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device.

Executive ViewAI

Why It Matters

Organizations using A vulnerability face notable risk from CVE-2015-5374 rated CVSS 7.8. Exploitation could compromise the security of affected deployments. With an EPSS score of 85%, this vulnerability faces very high likelihood of exploitation. A patch is available and should be applied as part of regular vulnerability management.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score

7.6/10

Composite threat intelligence

EPSS Score

84.7%

Top 1% exploitable

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS POC (1) THREAT

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 84.7%

Patch available Yes

Active threat Yes

Deciding rule

HIGH severity + EPSS > 10%

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

Very High

Priority Score

154

Low Medium High Critical

KEV: 0

EPSS: +85

CVSS: +39

PoC: +20

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.