Siemens SIPROTEC 5 Using DIGSI5 Protocol

Siemens SIPROTEC 5 devices contain a critical vulnerability that allows authenticated attackers to upload arbitrary, potentially malicious configuration files through the DIGSI 5 protocol, which could result in denial of service or remote code execution. The root cause is an insufficient file validation mechanism — the protocol lacked an allow-list to restrict what types of configuration files could be uploaded. This is especially concerning in operational technology (OT) and industrial control system (ICS) environments, where availability and integrity are mission-critical. Even authenticated users should not have unconstrained ability to upload arbitrary files to safety-critical devices, illustrating why least-privilege and input validation must be enforced at the protocol level.