Skip to content

EU CRA Statement

Introduction

This section provides information and instructions to the user regarding the SIO06/VWU product in compliance with the EU Cyber Resilience Act Annex II. It includes details on the product's features, usage guidelines, and security measures to ensure secure operation. Users are encouraged to read this section thoroughly to understand how to use the SIO06/VWU product responsibly and securely.

Meta Information

Version of this document: 1.0.0 Valid for SIO06/VWU firmware version: fw-sio06-01-02-default-2.3.0

Manufacturer Information (EU-CRA, Annex II, Section 1)

Ci4Rail GmbH

Address: Vogelweiherstr. 20, 90441 Nuremberg, Germany

Contact: info@ci4rail.com

Website: https://www.ci4rail.com

Reporting Cybersecurity Incidents (EU-CRA, Annex II, Section 2)

  • Vulnerabilities may be reported to security@ci4rail.com.
  • Reports should include affected product, version, description, impact, and reproduction steps.
  • Ci4Rail will acknowledge receipt within 5 working days and provide status updates during investigation.
  • We request coordinated disclosure and ask reporters not to publicly disclose vulnerabilities until a fix or mitigation is available.
  • Good-faith security research conducted according to this policy is welcome.

Unique Identification of the Product (EU-CRA, Annex II, Section 3)

The SIO06/VWU product is uniquely identified by the following information, all of the following information is required for unique identification:

  • Part number and serial number from name plate: e.g. P/N S103-SIO06-02-00001 - S/N 0000976
  • Firmware version: e.g. 2.3.0

This information can be obtained as follows:

  • Part number and serial number are printed on the product labels.
  • Hardware inventory information, including part number and serial number, can be read via the HTTPS REST API using GET /hardware.
  • Firmware version can be read via the HTTPS REST API using GET /firmware.

Intended Purpose of the Product (EU-CRA, Annex II, Section 4)

The SIO06/VWU is a remote and condition-based vehicle wake-up unit for rail vehicles. It is intended to remain connected to vehicle battery power even when the rest of the vehicle is powered down, and it communicates with a vehicle server via the 100 MBit/s Ethernet interface.

The SIO06/VWU receives relay and heartbeat watchdog commands from the vehicle server via TRDP and controls two relay outputs accordingly. It also acquires four digital inputs and two analog inputs and publishes their status to the vehicle server at a configurable cycle. A typical application is remote or condition-based wake-up of the vehicle, for example based on remote commands or sensor values evaluated by the vehicle server.

The SIO06/VWU additionally provides an HTTPS REST management interface for configuration, monitoring, firmware management, restart, and factory reset.

The SIO06/VWU is intended for use in rail vehicles only, in a closed network, and after professional installation by authorized specialist personnel. It is not intended for use on public or otherwise untrusted networks, outside the rail environment, or in safety-critical applications.

Security Measures

Access Control

The HTTPS REST management interface is protected by HTTP basic authentication with the user io4edge.

During production, the device is provisioned with a customer-specific factory password. Depending on the customer, this password is either unique to the customer or unique to each device. The password can be changed using PUT /users/io4edge/basic_auth.

The REST API is protected by HTTPS. The device is delivered with the factory-default sio06-initial certificate, whose only purpose is to provide a valid TLS certificate until the user's TLS certificate and matching private key are loaded. For operational use, replace it with credentials under the user's control using the PUT /certificate and PUT /key endpoints, followed by a restart. Clients shall not silently treat sio06-initial as normal operational trust.

The device should only be operated in a closed network. The TRDP process data interface, metrics interface, and log interface do not provide authentication or encryption.

Secure Boot and Firmware Updates

The device implements Secure Boot and Flash Encryption. Only firmware images signed by Ci4Rail can be booted. Firmware images with a lower secure version number than the currently installed version cannot be installed.

Firmware updates via the local console are disabled. Firmware updates are performed via the HTTPS REST API only. Before an update, the user should verify the current firmware version via GET /firmware and the hardware inventory via GET /hardware, and compare the hardware information with the firmware package compatibility information.

Firmware is installed using PUT /firmware over HTTPS. The firmware image is uploaded in chunks using the offset and last parameters. If the upload is successful, the device reboots automatically. If the new firmware does not start correctly, the device rolls back to the previous application firmware.

Known or Foreseeable Circumstances Which May Lead to Significant Cybersecurity Risks (EU-CRA, Annex II, Section 5)

The following circumstances can create significant cybersecurity risks:

  • Connecting the device to public, internet-connected, or otherwise untrusted networks. The TRDP process data interface, metrics interface, and log interface do not provide authentication or encryption.
  • Disclosure of the factory or user-configured REST API password.
  • Continuing to use the built-in or factory default HTTPS certificate in production instead of installing a certificate matching the device address and the operator's trust model.
  • Using the device outside the intended closed rail-vehicle environment or contrary to the documented system application conditions.

EU Declaration of Conformity (EU-CRA, Annex II, Section 6)

TODO:

Technical Security Support and Security Update Period (EU-CRA, Annex II, Section 7)

Ci4Rail offers technical security support through the vulnerability reporting contact security@ci4rail.com.

Updates

Firmware updates are provided through the SIO06 Public Firmware Repository.

Support Period

End of support period: 2046-06-30.

Instructions for Secure Use (EU-CRA, Annex II, Section 8)

(a) Measures During Initial Commissioning and Throughout the Lifetime of the Product

To ensure secure use of the SIO06/VWU, the user shall:

  • Install and operate the device only in rail vehicles and only through authorized specialist personnel.
  • Use the device only in a closed network.
  • Protect the factory or user-configured REST API password from disclosure. The password can be changed using PUT /users/io4edge/basic_auth.
  • Install a valid HTTPS server certificate and matching private key for the device address using PUT /certificate and PUT /key, then restart the device. Clients shall not silently treat the factory-default sio06-initial certificate as normal operational trust.
  • Monitor diagnostics such as device restarts, metrics, and logs, and investigate abnormal reset reasons.

(b) How Changes to the Product Can Affect the Security of Data

Changes to credentials, certificates, firmware, configuration, and network integration can affect the security of data:

  • If the factory or user-configured REST API password is disclosed, unauthorized parties may gain access to the management interface.
  • If the HTTPS certificate and private key do not match the deployment address or trust model, clients may be unable to authenticate the device correctly.
  • If the device is connected to a broader or untrusted network, unauthenticated interfaces can expose management-related metadata, device logs, metrics, and process data to unauthorized parties.
  • Configuration changes are stored persistently in non-volatile memory and remain active across restart. ParameterSet versioning should be used where possible to keep track of configuration changes.
  • A factory reset removes user configuration, the user-configured HTTPS certificate and private key, and any user-configured HTTPS API password. It restores both the factory-default sio06-initial certificate and the customer-specific factory password provisioned during production. The factory password is not a publicly accessible built-in password.

(c) How Security-Relevant Updates Can Be Installed

Security-relevant updates are installed as firmware updates via the HTTPS REST API:

  • Obtain the approved firmware release from the SIO06 Public Firmware Repository.
  • Read the current firmware version via GET /firmware and hardware inventory via GET /hardware.
  • Verify that the firmware release is compatible with the hardware inventory of the device.
  • Upload the firmware binary via PUT /firmware using chunked transfer with the offset and last query parameters.
  • After a successful upload, allow the device to reboot automatically and verify that the intended firmware version is active.

Only firmware images signed by Ci4Rail can be booted. Anti-rollback protection prevents installation of firmware with a lower secure version number than the currently installed version.

(d) Secure Decommissioning and Removal of User Data

This device does not store persistent user data. However, the user configuration, the user-configured HTTPS server certificate and private key, and any user-configured HTTPS API password are stored persistently in non-volatile memory.

Before decommissioning or redeploying the device:

  • Remove the device from the operational network.
  • Apply a factory reset either via the front reset button with a long activation (>10s) or via the POST /factoryreset REST API.

The factory reset does not erase firmware, ADC calibration, or hardware inventory data. Log data is not persistent and is lost on power-off or restart.

(e) Automatic Installation of Security Updates

Firmware and security-relevant updates are installed only via the HTTPS REST API, so there is no automatic-update setting for the user to disable.

(f) Information Necessary for Integrators

For integration into a larger system, the integrator shall take into account at least the following, security-relevant information:

  • The process data interface uses TRDP over Ethernet. The device implements a TRDP sink for relay and heartbeat watchdog commands and a TRDP source for analog and digital input status.
  • The TRDP process data interface is not authenticated or encrypted; integration shall therefore be limited to a closed and appropriately protected network.
  • Metrics are provided via HTTP and logs via plain-text TCP; those interfaces are not authenticated or encrypted.
  • Device management is performed via the HTTPS REST API.

Software Bill of Materials (SBOM) (EU-CRA, Annex II, Section 9)

SBOM can be accessed from the firmware release artifacts in the SIO06 Public Firmware Repository. Each release contains a licences.tar.gz archive with sbom.spdx, OPEN_SOURCE_NOTICES.txt, and the corresponding license texts.