CVE-2018-4840

2018-03-0817:00:00

CWE-306

siemens

www.cve.org

0.001 Low

EPSS

Percentile

49.8%

JSON

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords.

CNA Affected

[
  {
    "product": "DIGSI 4",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.92"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module DNP3 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V1.05.00"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 104 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 61850 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.30"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module Modbus TCP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module PROFINET IO variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf

0.001 Low

EPSS

Percentile

49.8%

JSON

Related for CVELIST:CVE-2018-4840