Executive Summary
SIPROTEC 5 protection relays generate session identifiers using insufficient entropy, which lets an unauthenticated remote attacker brute-force a valid session token and hijack an active user session on a subset of device endpoints. Because SIPROTEC 5 devices govern protective tripping and fault isolation across substation feeders, transformers, and busbars, a hijacked session gives an adversary a foothold in the exact logic that decides whether a fault is cleared or a breaker mis-operates.
Technical Exposure Breakdown
The defect is a classic weakness in random number quality. The session identifier space is not sufficiently unpredictable, so the effective keyspace an attacker must search collapses far below what a session token is supposed to provide. Once a legitimate user authenticates and establishes a session, an attacker on a network path to the device can iterate through plausible identifiers until one matches an active session. No credentials are required for the brute-force stage itself. The attacker inherits the privilege level of whatever session they successfully guess.
Siemens has scoped the exposure to a subset of endpoints provided by the affected products, not the full web and management surface. That scoping matters for prioritization, but it does not make the issue academic. The relevant question for each asset owner is whether the vulnerable endpoints are reachable from any segment an attacker could occupy, and whether an operator or engineer regularly holds an active session against those endpoints.
The published CVSS base score of 5.3 reflects the constraints: the attack is network-reachable and requires no authentication, but success depends on an active valid session existing at the time of the attack, and the direct impact is scoped rather than total device compromise. In an IT context that math is defensible. In an OT context the scoring understates the consequence, because the device sits in a protection loop where even limited unauthorized interaction can have physical outcomes.
OT Impact and Compliance Risk
SIPROTEC 5 is a line of digital protection relays. These are not administrative appliances. They monitor current and voltage, detect faults, and command circuit breakers. A hijacked management session, depending on the privileges of the guessed session and the exposed endpoint, could be used to read or alter configuration state, disrupt operator workflows, or serve as a staging point for deeper access. The failure mode that matters is a relay that no longer trips correctly, or trips when it should not, either of which propagates into equipment damage or unplanned outage.
For NERC CIP entities, this vulnerability lands squarely in CIP-007 system security management and CIP-010 configuration change management. A device whose session integrity cannot be trusted undermines the electronic access controls those standards assume. Under IEC 62443, this is a failure of the identification and authentication control family, specifically session integrity requirements, and it degrades the assumed security level of any zone containing these relays. Asset owners running these devices in transmission or generation protection schemes should treat this as a control that must be documented and compensated, not deferred.
Compensating Controls
Vendor fix versions are in preparation, but relay firmware changes in a live substation are slow, tested, and often tied to maintenance windows measured in months. Do not wait on the patch as your only line.
- Restrict reachability first. The vulnerable endpoints are only exploitable from a network path that reaches the device. Enforce that SIPROTEC 5 management interfaces are only accessible from a hardened engineering segment, never a flat process VLAN and never any routable path from IT.
- Do not active-scan these relays to find them. Aggressive scanning of protection devices can disrupt or brick industrial components. Inventory these assets from passive network monitoring and from asset management records, not from a probe.
- Reduce the window of a valid session. Enforce short session lifetimes and require operators and engineers to close sessions when work is done. The attack requires an active session to guess. Fewer active sessions means fewer targets.
- Virtual patch at the segment boundary. Deploy an inline network control that gates access to the vulnerable endpoints by source address and rejects unexpected clients. A Suricata rule concept here monitors for repeated, rapid session-identifier attempts against the relay's management endpoints from a single source and alerts on the brute-force pattern, since a guessing attack generates a high rate of near-identical requests that legitimate operator behavior does not.
Track each affected relay against the eventual fix version and record the compensating controls in your CIP-010 baseline so the mitigation is auditable.
BreachSpider Intel
BreachSpider tracks SIPROTEC 5 fix availability and exploitation signals across our 25,000+ ICS CVE dataset so OT teams can prioritize this against the rest of their exposure.