Siemens SIPROTEC 5 File Upload Flaw Enables Permanent DoS

Over 60 Siemens SIPROTEC 5 device models are vulnerable to an arbitrary file upload flaw that can permanently brick the devices. CVE-2025-40808 carries a CVSS score of 6.1 (MEDIUM) but don't let the number fool you - this is a high-risk scenario for any grid operator running these protection relays.

The vulnerability lives in the DIGSI5 protocol. An authenticated user can upload any file they want to the device. No restrictions, no filtering. Siemens' own advisory admits this could cause a permanent denial of service condition and potentially lead to code execution. That's a one-shot kill on a substation's protection logic.

Which Models Are Affected

Every SIPROTEC 5 variant with DIGSI5 support is in scope. The list spans 60+ specific part numbers across CP050, CP100, CP150, CP200, and CP300 hardware platforms. From the compact 7SX800 up to the 7UT87 transformer protection, if it runs DIGSI5, it's vulnerable. The advisory lists them all - too many to enumerate here. Check your inventory against the CISA ICSA-26-174-02.

The Fix and the Gap

Siemens has one real mitigation: upgrade firmware to V9.90 or later, or V10.00 for a few specific models (7ST85 and 7ST86 on CP300). Those versions introduce an allow-list feature that restricts which files can be uploaded. That closes the attack vector.

But here's the brutal part: for some products, no fix is planned. And for others, no fix is available yet. If you're running an unpatched model, you're stuck with compensating controls: password protect all DIGSI connections, use your own PKI-signed certificates, and enable role-based access control (RBAC) on devices with firmware V7.80 or higher.

What This Means for Operations

These relays sit in critical infrastructure - energy, transportation, healthcare, financial services. An attacker with valid credentials (or who compromises an engineering workstation) can push a malicious config that permanently disables the device. The grid design principle of multi-level redundant protection helps, but only if the redundant relays aren't also vulnerable.

Siemens recommends running devices in a protected IT environment with firewalls, segmentation, and VPNs. That's table-stakes advice. The real takeaway: if you can't patch immediately, audit your DIGSI access controls and lock down every engineering interface. No fix planned? Start planning for device replacement.

Source: Siemens SIPROTEC 5 Using DIGSI5 Protocol
Domain: cisa.gov