NotCVE - vendor:"Siemens" product:"En100 Ethernet Module Firmware"

Page 2 of 12 results (0.005 seconds)

CVSS: 5.9EPSS: 0%CPEs: 34EXPL: 0

CVE-2018-16563

https://notcve.org/view.php?id=CVE-2018-16563

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firmware variant MODBUS TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions), Firmware variant Profinet IO for EN100 Ethernet module (All versions), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.82), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. • https://cert-portal.siemens.com/productcert/pdf/ssa-104088.pdf •

CVSS: 5.3EPSS: 0%CPEs: 17EXPL: 0

CVE-2018-4839

https://notcve.org/view.php?id=CVE-2018-4839

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords. Se ha identificado una vulnerabilidad en Siemens DIGSI 4 (Todas las versiones anteriores a V4.92), EN100 Ethernet module DNP3 variant (Todas las versiones anteriores a V1.05.00), EN100 Ethernet module IEC 104 variant (Todas las versiones), EN100 Ethernet module IEC 61850 variant (Todas las versiones anteriores a V4.30), EN100 Ethernet module Modbus TCP variant (Todas las versiones), EN100 Ethernet module PROFINET IO variant (Todas las versiones), Other SIPROTEC 4 relays (Todas las versiones), Other SIPROTEC Compact relays (Todas las versiones), SIPROTEC 4 7SD80 (Todas las versiones anteriores a V4.70), SIPROTEC 4 7SJ61 (Todas las versiones anteriores a V4.96), SIPROTEC 4 7SJ62 (Todas las versiones anteriores a V4.96), SIPROTEC 4 7SJ64 (Todas las versiones anteriores a V4.96), SIPROTEC 4 7SJ66 (Todas las versiones anteriores a V4.30), SIPROTEC Compact 7SJ80 (Todas las versiones anteriores a V4.77), SIPROTEC Compact 7SK80 (Todas las versiones anteriores a V4.77). Un atacante con acceso local al sistema de ingeniería o en una posición de red privilegiada y capaz de obtener cierto tráfico de red podría reconstruir contraseñas de autorización de acceso • https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01 • CWE-326: Inadequate Encryption Strength •

CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-4838

https://notcve.org/view.php?id=CVE-2018-4838

A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module DNP3 variant (All versions < V1.04), EN100 Ethernet module PROFINET IO variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions < V1.22). The web interface (TCP/80) of affected devices allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. Se ha identificado una vulnerabilidad en la variante del módulo de Ethernet EN100 IEC 61850 (todas las versiones anteriores a la V4.30), la variante del módulo de Ethernet EN100 DNP3 (todas las versiones anteriores a la V1.04), la variante del módulo de Ethernet EN100 PROFINET IO (todas las versiones), la variante del módulo de Ethernet EN100 Modbus TCP (todas las versiones) y la variante del módulo de Ethernet EN100 IEC 104 (todas las versiones anteriores a la V1.22). La interfaz web (TCP/80) de los dispositivos afectados permite que un usuario no autenticado actualice o degrade el firmware del dispositivo, incluyendo versiones más antiguas con vulnerabilidades conocidas. • https://cert-portal.siemens.com/productcert/pdf/ssa-845879.pdf https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01 https://www.securityfocus.com/bid/103379 • CWE-306: Missing Authentication for Critical Function •

CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0

CVE-2018-4840

https://notcve.org/view.php?id=CVE-2018-4840

CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-7114

https://notcve.org/view.php?id=CVE-2016-7114

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02; SIPROTEC 7SJ686 : All versions < V 4.87; SIPROTEC 7UT686 : All versions < V 4.02; SIPROTEC 7SD686 : All versions < V 4.05; SIPROTEC 7SJ66 : All versions < V 4.30. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations. A legitimate user must be logged into the web interface for the attack to be successful. Se ha identificado una vulnerabilidad en la variante de Firmware PROFINET IO para los módulos EN100 Ethernet: en todas las versiones anteriores a V1.04.01; la variante de Firmware Modbus TCP para los módulos EN100 Ethernet: en todas las versiones anteriores a V1.11.00; la variante de Firmware v TCP para los módulos EN100 Ethernet: en todas las versiones anteriores a V1.03; la variante de Firmware IEC 104 para los módulos EN100 Ethernet: en todas las versiones anteriores a V1.21 y el módulo EN100 Ethernet incluido en SIPROTEC Merging Unit 6MU80: todas las versiones anteriores a la 1.02.02; SIPROTEC 7SJ686: todas las versiones anteriores a la V 4.87 y SIPROTEC 7UT686: todas las versiones anteriores a la V 4.02 y SIPROTEC 7SD686: todas las versiones anteriores a la V 4.05 y SIPROTEC 7SJ66: todas las versiones anteriores a la V 4.30. Los atacantes que tengan acceso de red a la interfaz web del dispositivo (puerto 80/tcp) podrían omitir la autenticación y realizar ciertas operaciones administrativas. • http://www.securityfocus.com/bid/92745 http://www.securityfocus.com/bid/99471 http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03 https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf • CWE-287: Improper Authentication •

1 2 3