Siemens Siprotec Missing Authentication for Critical Function

2019-11-0800:00:00

www.tenable.com

0.001 Low

EPSS

Percentile

49.8%

JSON

A vulnerability has been identified in Siemens DIGSI 4 (All versions < V4.92), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module PROFINET IO variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 104 variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords.

File data ot_500119.nasl

VendorProductVersionCPE
siemenssiprotec_compact_7sj80_firmware*cpe:2.3:o:siemens:siprotec_compact_7sj80_firmware:*:*:*:*:*:*:*:*
siemenssiprotec_compact_7sj80-cpe:2.3:h:siemens:siprotec_compact_7sj80:-:*:*:*:*:*:*:*
siemenssiprotec_compact_7sk80_firmware*cpe:2.3:o:siemens:siprotec_compact_7sk80_firmware:*:*:*:*:*:*:*:*
siemenssiprotec_compact_7sk80-cpe:2.3:h:siemens:siprotec_compact_7sk80:-:*:*:*:*:*:*:*
siemenssiprotec_4_7sj66_firmware*cpe:2.3:o:siemens:siprotec_4_7sj66_firmware:*:*:*:*:*:*:*:*
siemenssiprotec_4_7sj66-cpe:2.3:h:siemens:siprotec_4_7sj66:-:*:*:*:*:*:*:*
siemensdigsi_4*cpe:2.3:o:siemens:digsi_4:*:*:*:*:*:*:*:*
siemensen100_ethernet_module_iec_104_firmware-cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:*:*:*:*:*:*:*
siemensen100_ethernet_module_iec_104-cpe:2.3:h:siemens:en100_ethernet_module_iec_104:-:*:*:*:*:*:*:*
siemensen100_ethernet_module_dnp3_firmware-cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	siprotec_compact_7sj80_firmware	*	cpe:2.3:o:siemens:siprotec_compact_7sj80_firmware::::::::
siemens	siprotec_compact_7sj80	-	cpe:2.3:h:siemens:siprotec_compact_7sj80:-:::::::*
siemens	siprotec_compact_7sk80_firmware	*	cpe:2.3:o:siemens:siprotec_compact_7sk80_firmware::::::::
siemens	siprotec_compact_7sk80	-	cpe:2.3:h:siemens:siprotec_compact_7sk80:-:::::::*
siemens	siprotec_4_7sj66_firmware	*	cpe:2.3:o:siemens:siprotec_4_7sj66_firmware::::::::
siemens	siprotec_4_7sj66	-	cpe:2.3:h:siemens:siprotec_4_7sj66:-:::::::*
siemens	digsi_4	*	cpe:2.3:o:siemens:digsi_4::::::::
siemens	en100_ethernet_module_iec_104_firmware	-	cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:::::::*
siemens	en100_ethernet_module_iec_104	-	cpe:2.3:h:siemens:en100_ethernet_module_iec_104:-:::::::*
siemens	en100_ethernet_module_dnp3_firmware	-	cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:::::::*