Siemens DIGSI 4
At a glance
- Source
- NVD
- EPSS
- EPSS 0.58 % · percentile 48 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Modified
Description
A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.
Weaknesses (CWE)
- CWE-326 — Inadequate Encryption Strength
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.3 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.5 | AV:N/AC:M/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-16625
- GCVE · GCVE-0-2018-4839
CERT-FR advisories
- CERTFR-2018-AVI-117 — Multiples vulnérabilités dans SCADA les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:siemens:siprotec_compact_7sj80_firmware:*:*:*:*:*:*:*:*< 4.77cpe:2.3:o:siemens:siprotec_compact_7sk80_firmware:*:*:*:*:*:*:*:*< 4.77cpe:2.3:o:siemens:siprotec_4_7sj66_firmware:*:*:*:*:*:*:*:*< 4.30cpe:2.3:o:siemens:digsi_4:*:*:*:*:*:*:*:*< 4.92cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:*< 4.30
Affected products
| Product | Versions |
|---|---|
| Siemens · DIGSI 4 | affected All versions < V4.92 |
| Siemens · EN100 Ethernet module DNP3 variant | affected All versions < V1.05.00 |
| Siemens · EN100 Ethernet module IEC 104 variant | affected All versions |
| Siemens · EN100 Ethernet module IEC 61850 variant | affected All versions < V4.30 |
| Siemens · EN100 Ethernet module Modbus TCP variant | affected All versions |
| Siemens · EN100 Ethernet module PROFINET IO variant | affected All versions |
| Siemens · Other SIPROTEC 4 relays | affected All versions |
| Siemens · Other SIPROTEC Compact relays | affected All versions |
| Siemens · SIPROTEC 4 7SD80 | affected All versions < V4.70 |
| Siemens · SIPROTEC 4 7SJ61 | affected All versions < V4.96 |
| Siemens · SIPROTEC 4 7SJ62 | affected All versions < V4.96 |
| Siemens · SIPROTEC 4 7SJ64 | affected All versions < V4.96 |
| Siemens · SIPROTEC 4 7SJ66 | affected All versions < V4.30 |
| Siemens · SIPROTEC Compact 7SJ80 | affected All versions < V4.77 |
| Siemens · SIPROTEC Compact 7SK80 | affected All versions < V4.77 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |