# Siemens SIPROTEC 4 denial-of-service via file transfer flaw

Published: 2025-08-14 · Severity: routine · Sectors: energy, infrastructure, manufacturing
Canonical: https://vorant.io/reports/0f98c8cc-1a4f-51b0-a19c-1352b0f8e997/siemens-siprotec-4-denial-of-service-via-file-transfer-flaw

> Unauthenticated remote attackers can crash SIPROTEC 4 devices via malformed file transfer, requiring device restart; patches available for some models only.

Siemens SIPROTEC 4 and SIPROTEC 4 Compact protective relays contain an improper exception-handling flaw (CWE-754) in file transfer logic that allows unauthenticated remote attackers to trigger denial-of-service conditions. Affected devices fail to properly handle interrupted file transfer operations, causing them to become unresponsive and requiring manual restart to restore service. The vulnerability has CVSS v4 score of 8.7 with no authentication or user interaction required, and low attack complexity. This is a network-accessible critical manufacturing device affecting power systems and grid operations worldwide.

Siemens has provided patches only for three model lines (7SA6, 7SD5, and 7SD610 all updating to V4.78 or later); the majority of SIPROTEC 4 variants have no fix planned. Organizations should prioritize network segmentation and access controls, restricting direct exposure of these devices to untrusted networks. No active exploitation in the wild has been reported as of the advisory date.

## Mentioned in this report

- Vulnerabilities: CVE-2024-52504

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-12

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0f98c8cc-1a4f-51b0-a19c-1352b0f8e997/siemens-siprotec-4-denial-of-service-via-file-transfer-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup