CVE-2018-4839

2018-03-0817:00:00

CWE-326

siemens

www.cve.org

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.0%

JSON

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.

CNA Affected

[
  {
    "product": "DIGSI 4",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.92"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module DNP3 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V1.05.00"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 104 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 61850 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.30"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module Modbus TCP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module PROFINET IO variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Other SIPROTEC 4 relays",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "Other SIPROTEC Compact relays",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SD80",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.70"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ61",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.96"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ62",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.96"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ64",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.96"
      }
    ]
  },
  {
    "product": "SIPROTEC 4 7SJ66",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.30"
      }
    ]
  },
  {
    "product": "SIPROTEC Compact 7SJ80",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.77"
      }
    ]
  },
  {
    "product": "SIPROTEC Compact 7SK80",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.77"
      }
    ]
  }
]