CVE-2024-52504: Siemens SIPROTEC 4 DoS Vulnerability

CVE-2024-52504 Overview

CVE-2024-52504 affects a broad range of Siemens SIPROTEC 4 and SIPROTEC 4 Compact protection relays used in electrical substations and energy automation. The devices fail to properly handle interrupted file transfer operations, classified under [CWE-754] (Improper Check for Unusual or Exceptional Conditions). An unauthenticated remote attacker who can reach the device over the network can trigger a denial of service condition. Restoring normal operation requires a physical or remote restart of the affected relay, which has direct operational impact on power system protection functions.

Critical Impact
A remote, unauthenticated attacker can render SIPROTEC 4 protection relays unresponsive, requiring a device restart to recover, with potential consequences for substation availability.

Affected Products

SIPROTEC 4 relays: 6MD61, 6MD63, 6MD66, 6MD665, 7SA522, 7SJ61, 7SJ62, 7SJ63, 7SJ64, 7SJ66, 7SS52, 7ST6, 7UM61, 7UM62, 7UT612, 7UT613, 7UT63, 7VE6, 7VK61, 7VU683 (all versions)
SIPROTEC 4 7SA6, 7SD5, 7SD610 (all versions prior to V4.78)
SIPROTEC 4 Compact 7RW80, 7SD80, 7SJ80, 7SJ81, 7SK80, 7SK81 (all versions)

Discovery Timeline

2025-08-12 - CVE-2024-52504 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52504

Vulnerability Analysis

The flaw resides in the file transfer handling logic on SIPROTEC 4 devices. When an attacker initiates a file transfer over the network and then interrupts or terminates the session abnormally, the device does not correctly clean up or recover its internal state. The exceptional condition is not handled, leaving the protection relay in an unresponsive state.

Because SIPROTEC 4 devices perform critical protection functions for transmission lines, transformers, busbars, and generators, an extended denial of service can leave portions of a substation without active protective relaying until a restart is completed. The vulnerability requires no authentication, no user interaction, and only network access to the device's management interface.

Root Cause

The root cause is improper exception handling [CWE-754] in the file transfer subsystem. Incoming transfers that are interrupted mid-operation are not gracefully aborted, and resources or state machines associated with the transfer are not reset. Repeated or single malformed sessions can therefore lock the device.

Attack Vector

The attack vector is network-based. An attacker with reachability to the SIPROTEC 4 device's IP interface initiates a file transfer operation and then interrupts it, for example by terminating the TCP connection at a specific stage of the protocol exchange. No credentials are required. The impact is restricted to availability, with no confidentiality or integrity loss reported. Refer to the Siemens Security Advisory SSA-400089 for the protocol-level technical specifics.

Detection Methods for CVE-2024-52504

Indicators of Compromise

SIPROTEC 4 device becomes unresponsive to engineering tools such as DIGSI 4 or to SCADA polling, with recovery only after a device restart.
Abnormal volumes of incomplete or abruptly terminated file transfer sessions targeting SIPROTEC 4 device IP addresses.
Loss of communication alarms from substation gateways or RTUs correlated with prior inbound traffic to the relay management ports.

Detection Strategies

Monitor TCP sessions to SIPROTEC 4 devices for unusual rates of RST or FIN packets occurring mid-transfer.
Baseline expected file transfer activity from authorized engineering workstations and alert on transfers from unexpected source addresses.
Correlate device unavailability events with preceding network sessions to identify exploitation attempts.

Monitoring Recommendations

Enable syslog or SNMP trap forwarding from SIPROTEC 4 devices and substation switches into a centralized log platform for continuous availability monitoring.
Deploy ICS-aware network monitoring on substation LANs to inspect IEC 61850, DIGSI, and related protocol traffic for anomalies.
Track device uptime metrics and alert on unexpected restarts of protection relays.

How to Mitigate CVE-2024-52504

Immediate Actions Required

Restrict network access to SIPROTEC 4 device management interfaces to authorized engineering workstations and substation automation systems only.
Place all SIPROTEC 4 devices behind ICS firewalls or within isolated substation VLANs, following IEC 62443 zone and conduit segmentation.
Inventory deployed SIPROTEC 4 and SIPROTEC 4 Compact relays and identify those running firmware versions covered by Siemens advisory SSA-400089.

Patch Information

Siemens has released firmware V4.78 for SIPROTEC 4 7SA6, 7SD5, and 7SD610, which addresses this issue. For the remaining affected SIPROTEC 4 and SIPROTEC 4 Compact models listed as "all versions," no fix is currently available, and operators must rely on compensating network controls. See the Siemens Security Advisory SSA-400089 for the authoritative remediation status per model.

Workarounds

Apply defense-in-depth measures consistent with Siemens' operational guidelines for industrial security, including dedicated firewalls and jump hosts.
Block external access to SIPROTEC 4 protocol ports at the perimeter and disable any unused services on the devices.
Restrict file transfer operations to maintenance windows and to whitelisted source IPs, and validate device responsiveness after each engineering session.

bash

# Example perimeter ACL restricting access to a SIPROTEC 4 relay
# Replace SIPROTEC_IP and ENG_WS_IP with actual addresses
access-list SUBSTATION_IN permit ip host ENG_WS_IP host SIPROTEC_IP
access-list SUBSTATION_IN deny   ip any host SIPROTEC_IP log
access-list SUBSTATION_IN permit ip any any