CVE-2018-4840

🗓️ 08 Mar 2018 17:00:00Reported by siemensType

Vulnerability in DIGSI 4 and EN100 Ethernet Module

Reporter	Title	Published	Views	Family All 10
CNVD	Siemens Multiple Product File Upload Vulnerability	9 Mar 201800:00	–	cnvd
Cvelist	CVE-2018-4840	8 Mar 201817:00	–	cvelist
EUVD	EUVD-2018-16626	7 Oct 202500:30	–	euvd
ICS	Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module (Update D)	8 Mar 201800:00	–	ics
NVD	CVE-2018-4840	8 Mar 201817:29	–	nvd
OSV	CVE-2018-4840	8 Mar 201817:29	–	osv
Tenable Nessus	Siemens Siprotec Missing Authentication for Critical Function	8 Nov 201900:00	–	nessus
Tenable Nessus	Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module Missing Authentication For Critical Function (CVE-2018-4840)	7 Feb 202200:00	–	nessus
Prion	Authorization	8 Mar 201817:29	–	prion
Positive Technologies	PT-2018-03: Control Takeover in Siemens DIGSI 4 and EN100 Ethernet modules	17 Dec 201500:00	–	ptsecurity

NVD

Node

siemens siprotec_compact_7sj80_firmwareRange<4.77

AND

siemens siprotec_compact_7sj80Match-

Node

siemens siprotec_compact_7sk80_firmwareRange<4.77

AND

siemens siprotec_compact_7sk80Match-

Node

siemens siprotec_4_7sj66_firmwareRange<4.30

AND

siemens siprotec_4_7sj66Match-

Node

siemens digsi_4Range<4.92

Node

siemens en100_ethernet_module_iec_104_firmwareMatch-

AND

siemens en100_ethernet_module_iec_104Match-

Node

siemens en100_ethernet_module_dnp3_firmwareMatch-

AND

siemens en100_ethernet_module_dnp3Match-

Node

siemens en100_ethernet_module_modbus_tcp_firmwareMatch-

AND

siemens en100_ethernet_module_modbus_tcpMatch-

Node

siemens en100_ethernet_module_profinet_io_firmwareMatch-

AND

siemens en100_ethernet_module_profinet_ioMatch-

Node

siemens en100_ethernet_module_iec_61850_firmwareRange<4.30

AND

siemens en100_ethernet_module_iec_61850Match-

[
  {
    "product": "DIGSI 4",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.92"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module DNP3 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V1.05.00"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 104 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 61850 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.30"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module Modbus TCP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module PROFINET IO variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-18-067-01

21 Nov 2024 04:07Current

7.4High risk

Vulners AI Score7.4

CVSS 25

CVSS 37.5

EPSS0.0024

CWE-306