Firmware analyzer of intelligent electronic devices in substations based on vulnerability databases

Modern society relies heavily on the smooth operation of its critical infrastructure. Emerging technologies contribute to high living standards, while industrialized countries depend on information and communication systems for transportation, communication, financial transactions, food supply, and healthcare services. Industrial Control Systems (ICS) are essential for overseeing, maintaining, and managing these critical infrastructures. In the energy sector, ICS is vital for power generation, transmission, and distribution. With the increasing interconnectivity of the Smart Grid, functions such as protection, control, and monitoring have become heavily dependent on rapidly evolving communication infrastructures. Substations play a central role in the distribution process by transforming high-voltage electricity into low voltage, and digital substations offer additional advantages such as improved measurement accuracy, ease of configuration, and real-time performance. These substations also incorporate additional digital components, including electronic relays, merging units, SCADA gateways, HMIs, time synchronization devices, and networking equipment. While this digital integration has significantly enhanced the performance of the energy systems—offering benefits like improved service quality, operational efficiency, automation, and cost savings—it has also led to a surge in cyber-attacks due to the exposure of industrial devices to the internet. This connectivity has broadened the attack surface, giving threat actors more opportunities to compromise critical systems. A well-orchestrated cyber-attack on the power grid could result in severe equipment damage and widespread blackouts. Within smart grids, Intelligent Electronic Devices (IEDs) serve as essential elements, providing functions such as protection, control, real-time monitoring, measurement, and communication. Categorized into control, monitoring, and protection types, IEDs work together to enhance the reliability, maintainability, and quality of the power system and are generally compatible with protocols such as IEC 61850, Modbus, and DNP3. A single multifunctional IED can simultaneously incorporate protection functions, communication protocols, and monitoring capabilities. However, the widespread adoption of Ethernet and TCP/IP-based communication has exposed these devices to the internet and wide-area networks, leaving them vulnerable to cyberattacks. Compromising an IED can lead to the takeover of substation equipment control, manipulation of measurements, and cascading failures that put the entire grid at risk. Therefore, identifying software vulnerabilities in IEDs and implementing protective measures against them is a vital task for cybersecurity experts. Technically, vulnerability detections are carried out using either passive or active scanning techniques. Research indicates that passive methods are generally more efficient, providing accurate results with minimal scanning time and without introducing disruptive traffic into the network. This is particularly important for ICS systems, which are highly sensitive and can be destabilized or shut down by the intrusive traffic generated by active scanners. Therefore, Passive Vulnerability Detection (PVD) is typically more suitable for Operational Technology (OT) environments. The cornerstone of any vulnerability scanning process—especially passive scanning—is the precise identification of devices. If any static attribute of a device is incorrectly defined, the vulnerability scanning results may be inaccurate. This device information is typically maintained in the OT asset inventory, which every industrial organization should possess. Despite its importance for cybersecurity and vulnerability management, maintaining a complete and accurate asset inventory remains a major challenge—especially for embedded industrial devices like Programmable Logic Controllers (PLCs) and IEDs. Acknowledging these challenges, this study assumes the presence of gaps in current asset inventories and proposes a method to extract detailed device information (such as manufacturer, model, serial number, and hardware/software versions) from configuration files before initiating vulnerability scans. In the Passive Vulnerability Detection (PVD) method, system components are generally matched with CVE–CPE records. However, this approach has limitations: some CVE entries lack CPE identifiers, there may be gaps or outdated data in CPE–CVE mappings, and inconsistent CPE assignments for the same product can be observed across different sources. Moreover, in security advisories and notices issued by vendors, instead of the devices' CPEs, static information such as models, software and hardware versions, and design standards is provided. For these reasons, in this work, vulnerabilities are identified by matching based on this device information rather than relying on CPE. IEC 61850 is an international standard designed to standardize communication between Intelligent Electronic Devices (IEDs) in substations. It organizes device data using a hierarchical, object-oriented model, allowing each data object to be uniquely identified and accessed across the network through the MMS protocol. In addition, the standard introduces the Substation Configuration Language (SCL), an XML-based format that describes the configuration of IEC 61850 systems. SCL files serve as comprehensive documentation, detailing device characteristics and the overall system topology. This work presents a semi-automated and non-intrusive approach to vulnerability detection in IEDs within Industrial Control Systems (ICS), specifically designed for smart grid applications. The proposed method utilizes Substation Configuration Language (SCL) files compliant with the IEC 61850 standard to extract static attributes of IEDs — including vendor, model, hardware, and firmware versions — without requiring direct interaction with operational networks. These extracted attributes are then correlated with publicly available security advisories from device manufacturers (e.g., ABB), the National Vulnerability Database (NVD), and the Common Weakness Enumeration (CWE) database to generate a comprehensive vulnerability report for each identified IED. Reports reveal that over 60% of ICS companies rely on vendor-issued security advisories to detect flaws in their equipment. This study focuses particularly on streamlining this process, introducing a tool that automates vulnerability reporting for one or more IEDs, helping operators save time and effort. A three-stage method is proposed for identifying vulnerabilities in IEDs:  Preparation stage: A comprehensive vulnerability database was created using data obtained from sources such as ABB security bulletins, the NVD, and the CWE. The vulnerability data were stored in a MySQL database.  Manual operations stage: The IP addresses of the IEDs in the target system were identified through Nmap's ARP scan, after which the SCL files were extracted using IEDExplorer and stored for analysis.  Automated processing stage: A Python-based program parsed these files to determine the static information of the device, which was then matched with the database to generate device-specific reports containing the relevant vulnerabilities and mitigation recommendations. Additionally, the user may manually enter the information of a device. In this case, the vulnerability detection process is carried out in the same way without parsing SCL files. Unlike injectionsal Active Vulnerability Scanning (AVS) tools, which may disrupt OT systems due to high network traffic or intrusive queries, the proposed Passive Vulnerability Detection (PVD) approach ensures safe operation by avoiding any packet injection or intrusive actions. The generated vulnerability reports not only list known CVEs affecting each IED but also include critical metadata such as risk scores, attack vectors, weakness classifications, affected versions, vendor-issued patches, and suggested mitigations. This extensive dataset is assembled into a structured and searchable database that can serve both operational engineers and cybersecurity analysts in evaluating the exposure and resilience of their ICS infrastructure. Experimental validation of the system was conducted using a realistic test environment, the energy systems—covering production, transmission, distribution, and consumption—at the National Critical Infrastructures Testbed Center at Sakarya University (CENTER Energy). It was successfully evaluated on ABB's REF615, REL650, and RET670 IED devices and the proposed solution produced accurate results including all the known vulnerabilities affecting each device. The results highlight the feasibility and effectiveness of combining IEC 61850 configuration parsing with passive vulnerability detection correlation for enhancing the cybersecurity posture of substations and other ICS components. To the best of our knowledge, this is the first study to automate the end-to-end process of extracting IED information from SCL files and enriching it with data from NVD, CWE, and vendor disclosures to produce actionable vulnerability assessments. Furthermore, this research contributes a reusable and extensible database model that can be scaled to support multiple device vendors, enabling wider applicability in real-world OT/ICS environments. The proposed methodology bridges a crucial gap in ICS cybersecurity, where asset visibility and vulnerability intelligence often remain fragmented and outdated. In conclusion, this thesis provides a practical, scalable, and accurate approach to vulnerability assessment in critical infrastructure environments. By integrating standardized configuration analysis with threat intelligence sources, it lays the groundwork for future developments in automated, real-time, and vendor-agnostic cybersecurity solutions for ICS. Future improvements may include expanding the tool's database to include IEDs from various vendors and automating both the database generation and configuration files retrieval processes.