Page 3 of 16 results (0.008 seconds)

CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0

CVE-2018-4838

https://notcve.org/view.php?id=CVE-2018-4838

A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module DNP3 variant (All versions < V1.04), EN100 Ethernet module PROFINET IO variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions < V1.22). The web interface (TCP/80) of affected devices allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. Se ha identificado una vulnerabilidad en la variante del módulo de Ethernet EN100 IEC 61850 (todas las versiones anteriores a la V4.30), la variante del módulo de Ethernet EN100 DNP3 (todas las versiones anteriores a la V1.04), la variante del módulo de Ethernet EN100 PROFINET IO (todas las versiones), la variante del módulo de Ethernet EN100 Modbus TCP (todas las versiones) y la variante del módulo de Ethernet EN100 IEC 104 (todas las versiones anteriores a la V1.22). La interfaz web (TCP/80) de los dispositivos afectados permite que un usuario no autenticado actualice o degrade el firmware del dispositivo, incluyendo versiones más antiguas con vulnerabilidades conocidas. • https://cert-portal.siemens.com/productcert/pdf/ssa-845879.pdf https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01 https://www.securityfocus.com/bid/103379 • CWE-306: Missing Authentication for Critical Function •

CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0

CVE-2018-4840

https://notcve.org/view.php?id=CVE-2018-4840

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords. Se ha identificado una vulnerabilidad en Siemens DIGSI 4 (Todas las versiones anteriores a V4.92), EN100 Ethernet module DNP3 variant (Todas las versiones anteriores a V1.05.00), EN100 Ethernet module IEC 104 variant (Todas las versiones), EN100 Ethernet module IEC 61850 variant (Todas las versiones anteriores a V4.30), EN100 Ethernet module Modbus TCP variant (Todas las versiones), EN100 Ethernet module PROFINET IO variant (Todas las versiones). El mecanismo de ingeniería del dispositivo permite que un usuario remoto no autenticado suba una configuración de dispositivo modificada que sobrescriba las contraseñas de autorización de acceso • https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01 • CWE-306: Missing Authentication for Critical Function •

CVSS: 5.3EPSS: 0%CPEs: 17EXPL: 0

CVE-2018-4839

https://notcve.org/view.php?id=CVE-2018-4839

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords. Se ha identificado una vulnerabilidad en Siemens DIGSI 4 (Todas las versiones anteriores a V4.92), EN100 Ethernet module DNP3 variant (Todas las versiones anteriores a V1.05.00), EN100 Ethernet module IEC 104 variant (Todas las versiones), EN100 Ethernet module IEC 61850 variant (Todas las versiones anteriores a V4.30), EN100 Ethernet module Modbus TCP variant (Todas las versiones), EN100 Ethernet module PROFINET IO variant (Todas las versiones), Other SIPROTEC 4 relays (Todas las versiones), Other SIPROTEC Compact relays (Todas las versiones), SIPROTEC 4 7SD80 (Todas las versiones anteriores a V4.70), SIPROTEC 4 7SJ61 (Todas las versiones anteriores a V4.96), SIPROTEC 4 7SJ62 (Todas las versiones anteriores a V4.96), SIPROTEC 4 7SJ64 (Todas las versiones anteriores a V4.96), SIPROTEC 4 7SJ66 (Todas las versiones anteriores a V4.30), SIPROTEC Compact 7SJ80 (Todas las versiones anteriores a V4.77), SIPROTEC Compact 7SK80 (Todas las versiones anteriores a V4.77). Un atacante con acceso local al sistema de ingeniería o en una posición de red privilegiada y capaz de obtener cierto tráfico de red podría reconstruir contraseñas de autorización de acceso • https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01 • CWE-326: Inadequate Encryption Strength •

CVSS: 8.7EPSS: 0%CPEs: 76EXPL: 0

CVE-2017-12741

https://notcve.org/view.php?id=CVE-2017-12741

Specially crafted packets sent to port 161/udp could cause a denial of service condition. The affected devices must be restarted manually. Se ha identificado una vulnerabilidad en Development/Evaluation Kits para PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits para PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits para PROFINET IO: EK-ERTEC 200P, SIMATIC Compact Field Unit, SIMATIC ET200AL, SIMATIC ET200M (incluidas las variantes SIPLUS), SIMATIC ET200MP IM155-5 PN BA (incluidas las variantes SIPLUS), SIMATIC ET200MP IM155-5 PN HF (incluidas las variantes SIPLUS), SIMATIC ET200MP IM155-5 PN ST (incluidas las variantes SIPLUS), SIMATIC ET200S (incluidas las variantes SIPLUS), SIMATIC ET200SP IM155-6 PN BA (incluidas las variantes SIPLUS), SIMATIC ET200SP IM155-6 PN HA (incluidas las variantes SIPLUS), SIMATIC ET200SP IM155-6 PN HF (incluidas las variantes SIPLUS), SIMATIC ET200SP IM155-6 PN HS (incluidas las variantes SIPLUS), SIMATIC ET200SP IM155-6 PN ST (incluidas las variantes SIPLUS), SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 4AO U/I 4xM12, SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12, SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12, SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN: IO-Link Master, SIMATIC ET200pro, SIMATIC PN/PN Coupler (incluidas las variantes SIPLUS NET), familia SIMATIC S7-1200 CPU (incluidas las variantes SIPLUS), familia SIMATIC S7-1500 CPU (incluyendo las variantes relacionadas ET200 CPUs y SIPLUS), SIMATIC S7-1500 Software Controller, SIMATIC S7-200 SMART, familia SIMATIC S7-300 CPU (incluyendo las variantes relacionadas ET200 CPUs y SIPLUS), SIMATIC S7-400 H V6 CPU familia y posteriores (incluidas las variantes SIPLUS), SIMATIC S7-400 PN/DP V6 CPU familia y posteriores (incluidas las variantes SIPLUS), familia SIMATIC S7-400 PN/DP V7 CPU (incluidas las variantes SIPLUS), familia SIMATIC S7-410 V8 CPU (incluidas las variantes SIPLUS), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMATIC WinAC RTX (F) 2010, SIMOCODE pro V EIP (incluidas las variantes SIPLUS), SIMOCODE pro V PN (incluidas las variantes SIPLUS), SIMOTION C, SIMOTION D (incluidas las variantes SIPLUS), SIMOTION D4xx V4.4 para SINAMICS SM150i-2 w. PROFINET (incluidas las variantes SIPLUS), SIMOTION P V4.4 and V4.5, SIMOTION P V5, SINAMICS DCM w. PN, SINAMICS DCP w. • https://cert-portal.siemens.com/productcert/html/ssa-141614.html https://cert-portal.siemens.com/productcert/html/ssa-346262.html https://cert-portal.siemens.com/productcert/html/ssa-546832.html https://cert-portal.siemens.com/productcert/pdf/ssa-141614.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-346262.pdf https://cert-portal.siemens.com/productcert/pdf/ssa-546832.pdf https://www.securityfocus.com/bid/101964 • CWE-400: Uncontrolled Resource Consumption •

CVSS: 7.1EPSS: 0%CPEs: 181EXPL: 0

CVE-2017-2681

https://notcve.org/view.php?id=CVE-2017-2681

Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial of service condition of that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected. This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices. Los paquetes PROFINET DCP especialmente diseñados que se envían en un segmento Ethernet local (capa 2) a un producto afectado podrían causar una condición de denegación de servicio de ese producto. • http://www.securityfocus.com/bid/98369 http://www.securitytracker.com/id/1038463 https://cert-portal.siemens.com/productcert/html/ssa-293562.html https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-293562.pdf • CWE-400: Uncontrolled Resource Consumption •