Lucene search

[email protected]CVE-2016-9154

HistoryDec 23, 2016 - 5:59 a.m.

CVE-2016-9154

2016-12-2305:59:00

CWE-332

[email protected]

web.nvd.nist.gov

siemens

desigo px

web modules

cve-2016-9154

cybersecurity

vulnerability

https

pseudo random number generator

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.3%

JSON

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

Affected configurations

NVD

Node

siemensdesigo_web_module_pxa30-w0_firmwareRange≤6.00.00

siemensdesigo_web_module_pxa30-w1_firmwareRange≤6.00.00

siemensdesigo_web_module_pxa30-w2_firmwareRange≤6.00.00

siemensdesigo_web_module_pxa40-w0_firmwareRange≤6.00.00

siemensdesigo_web_module_pxa40-w1_firmwareRange≤6.00.00

siemensdesigo_web_module_pxa40-w2_firmwareRange≤6.00.00

AND

siemensdesigo_web_module_pxa30-w0Match-

siemensdesigo_web_module_pxa30-w1Match-

siemensdesigo_web_module_pxa30-w2Match-

siemensdesigo_web_module_pxa40-w0Match-

siemensdesigo_web_module_pxa40-w1Match-

siemensdesigo_web_module_pxa40-w2Match-

CPENameOperatorVersion
siemens:desigo_web_module_pxa30-w0_firmwaresiemens desigo web module pxa30-w0 firmwarele6.00.00
siemens:desigo_web_module_pxa30-w1_firmwaresiemens desigo web module pxa30-w1 firmwarele6.00.00
siemens:desigo_web_module_pxa30-w2_firmwaresiemens desigo web module pxa30-w2 firmwarele6.00.00
siemens:desigo_web_module_pxa40-w0_firmwaresiemens desigo web module pxa40-w0 firmwarele6.00.00
siemens:desigo_web_module_pxa40-w1_firmwaresiemens desigo web module pxa40-w1 firmwarele6.00.00
siemens:desigo_web_module_pxa40-w2_firmwaresiemens desigo web module pxa40-w2 firmwarele6.00.00

CPE	Name	Operator	Version
siemens:desigo_web_module_pxa30-w0_firmware	siemens desigo web module pxa30-w0 firmware	le	6.00.00
siemens:desigo_web_module_pxa30-w1_firmware	siemens desigo web module pxa30-w1 firmware	le	6.00.00
siemens:desigo_web_module_pxa30-w2_firmware	siemens desigo web module pxa30-w2 firmware	le	6.00.00
siemens:desigo_web_module_pxa40-w0_firmware	siemens desigo web module pxa40-w0 firmware	le	6.00.00
siemens:desigo_web_module_pxa40-w1_firmware	siemens desigo web module pxa40-w1 firmware	le	6.00.00
siemens:desigo_web_module_pxa40-w2_firmware	siemens desigo web module pxa40-w2 firmware	le	6.00.00

CNA Affected

[
  {
    "product": "Desigo PX Web modules with all firmware versions < V6.00.046",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Desigo PX Web modules with all firmware versions < V6.00.046"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94962

www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf

ics-cert.us-cert.gov/advisories/ICSA-16-355-01

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.3%

JSON

Related for CVE-2016-9154

ics1 nvd1 prion1 cvelist1 threatpost1