Lucene search

MitreCVE-2016-7112

HistorySep 06, 2016 - 12:59 a.m.

CVE-2016-7112

2016-09-0600:59:00

CWE-287

mitre

web.nvd.nist.gov

cve-2016-7112

firmware

en100 ethernet

profinet io

modbus tcp

dnp3 tcp

iec 104

siprotec merging unit 6mu80

authentication bypass

administrative operations

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

73.2%

JSON

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Attackers with network access to the device’s web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations.

Affected configurations

Nvd

Node

siemensen100_ethernet_module_firmwareRange≤4.28

AND

siemensen100_ethernet_moduleMatch-

VendorProductVersionCPE
siemensen100_ethernet_module_firmware*cpe:2.3:a:siemens:en100_ethernet_module_firmware:*:*:*:*:*:*:*:*
siemensen100_ethernet_module-cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	en100_ethernet_module_firmware	*	cpe:2.3:a:siemens:en100_ethernet_module_firmware::::::::
siemens	en100_ethernet_module	-	cpe:2.3:h:siemens:en100_ethernet_module:-:::::::*

References

www.securityfocus.com/bid/92747

www.securityfocus.com/bid/99471

www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf

ics-cert.us-cert.gov/advisories/ICSA-17-187-03

www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.004

Percentile

73.2%

JSON

Related for CVE-2016-7112