Siemens SIPROTEC 4 denial-of-service via file transfer flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated remote attackers can crash SIPROTEC 4 devices via malformed file transfer, requiring device restart; patches available for some models only.
Siemens SIPROTEC 4 and SIPROTEC 4 Compact protective relays contain an improper exception-handling flaw (CWE-754) in file transfer logic that allows unauthenticated remote attackers to trigger denial-of-service conditions. Affected devices fail to properly handle interrupted file transfer operations, causing them to become unresponsive and requiring manual restart to restore service. The vulnerability has CVSS v4 score of 8.7 with no authentication or user interaction required, and low attack complexity. This is a network-accessible critical manufacturing device affecting power systems and grid operations worldwide.
Siemens has provided patches only for three model lines (7SA6, 7SD5, and 7SD610 all updating to V4.78 or later); the majority of SIPROTEC 4 variants have no fix planned. Organizations should prioritize network segmentation and access controls, restricting direct exposure of these devices to untrusted networks. No active exploitation in the wild has been reported as of the advisory date.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-12
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs