Lucene search

[email protected]CVE-2018-4839

HistoryMar 08, 2018 - 5:29 p.m.

CVE-2018-4839

2018-03-0817:29:00

CWE-326

[email protected]

web.nvd.nist.gov

cve-2018-4839

digsi 4

siprotec

vulnerability

access authorization

network security

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.0%

JSON

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.

Affected configurations

NVD

Node

siemenssiprotec_compact_7sj80Match-

AND

siemenssiprotec_compact_7sj80_firmwareRange<4.77

Node

siemenssiprotec_compact_7sk80Match-

AND

siemenssiprotec_compact_7sk80_firmwareRange<4.77

Node

siemenssiprotec_4_7sj66Match-

AND

siemenssiprotec_4_7sj66_firmwareRange<4.30

Node

siemensdigsi_4Range<4.92

Node

siemensen100_ethernet_module_iec_104Match-

AND

siemensen100_ethernet_module_iec_104_firmwareMatch-

Node

siemensen100_ethernet_module_dnp3Match-

AND

siemensen100_ethernet_module_dnp3_firmwareMatch-

Node

siemensen100_ethernet_module_modbus_tcpMatch-

AND

siemensen100_ethernet_module_modbus_tcp_firmwareMatch-

Node

siemensen100_ethernet_module_profinet_ioMatch-

AND

siemensen100_ethernet_module_profinet_io_firmwareMatch-

Node

siemensen100_ethernet_module_iec_61850Match-

AND

siemensen100_ethernet_module_iec_61850_firmwareRange<4.30

CPENameOperatorVersion
siemens:siprotec_compact_7sj80_firmwaresiemens siprotec compact 7sj80 firmwarelt4.77

CPE	Name	Operator	Version
siemens:siprotec_compact_7sj80_firmware	siemens siprotec compact 7sj80 firmware	lt	4.77

CNA Affected

[
  {
    "product": "DIGSI 4",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.92"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module DNP3 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V1.05.00"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 104 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 61850 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.30"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module Modbus TCP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module PROFINET IO variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Other SIPROTEC 4 relays",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Other SIPROTEC Compact relays",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SD80",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.70"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ61",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.96"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ62",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.96"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ64",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.96"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ66",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.30"
      }
    ]
  },
  {
    "product": "SIPROTEC Compact 7SJ80",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.77"
      }
    ]
  },
  {
    "product": "SIPROTEC Compact 7SK80",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.77"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf

ics-cert.us-cert.gov/advisories/ICSA-18-067-01

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.0%

JSON

Related for CVE-2018-4839

nessus2 prion1 cvelist1 nvd1 ptsecurity1 ics1