Ethernet Vulnerabilities in Safety Instrumented Systems (SIS): A Key Difference
Summary: Dragos reported five security defects in Schneider Electric's Triconex Safety Instrumented System, two of them in the Ethernet-based Tricon Communication Module (TCM): CVE-2020-7486, a denial of service that can put the TCM into a fault state, and CVE-2020-7491, a root-style flaw that allows firmware modification of the TCM. Dragos says the defects can be exploited even while the SIS key switch is in "Run" mode, and that other safety controllers using add-on Ethernet modules are likely vulnerable to similar attacks.
Key Takeaway: The root vulnerability lets an attacker stage a payload such as TRISIS on the TCM card, wait for the keyswitch to move to "Remote" or "Program," then load it into the logic processor - and use the TCM's position to hide the changes from TriStation, historians, HMI systems, and other monitoring. The keyswitch, widely treated as the control that prevents SIS manipulation, does nothing against these flaws.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2020-7486CVE-2020-7491
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026