Siemens SIPROTEC 4/SIPROTEC Compact Denial of Service Vulnerability

SIPROTEC 4 and SIPROTEC Compact devices provide a wide range of centralized protection, control and automation functions for substations and other applications. A denial of service vulnerability exists in Siemens SIPROTEC 4, SIPROTEC Compact devices, versions prior to EN100 Ethernet 4.29. A remot...

Siemens SIPROTEC 4 and SIPROTEC Compact Vulnerabilities

OVERVIEW Siemens reports that they have released a firmware update for SIPROTEC 4 and SIPROTEC Compact devices to mitigate authentication bypass and resource exhaustion vulnerabilities. Kirill Nesterov and Anatoly Katushin from Kaspersky Lab reported some of these vulnerabilities directly to...

CVE-2016-4785

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4784

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4784

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

Design/Logic Flaw

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

Design/Logic Flaw

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4785

SiemenS SIPROTEC 4/Compact EN100 Ethernet modules are affected by CVE-2016-4785. The integrated web server (port 80) could disclose a limited amount of device memory content to remote attackers with network access, and the issue only affects EN100 Ethernet modules inside SIPROTEC4 and SIPROTEC Co...

CVE-2016-4785

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4784

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4784

CVE-2016-4784 affects Siemens SIPROTEC SIPROTEC 4/Compact devices with EN100 Ethernet module and SIPROTEC Merging Unit 6MU80. The vulnerability is information disclosure via the integrated web server (port 80) when network access is possible, allowing remote attackers to obtain sensitive device i...

PT-2016-6138

Name of the Vulnerable Software and Affected Versions EN100 Ethernet module firmware variant PROFINET IO versions prior to V1.04.01 EN100 Ethernet module firmware variant Modbus TCP versions prior to V1.11.00 EN100 Ethernet module firmware variant DNP3 TCP versions prior to V1.03 EN100 Ethernet...

PT-2016-6139

Name of the Vulnerable Software and Affected Versions Firmware variant PROFINET IO for EN100 Ethernet module versions prior to V1.04.01 Firmware variant Modbus TCP for EN100 Ethernet module versions prior to V1.11.00 Firmware variant DNP3 TCP for EN100 Ethernet module versions prior to V1.03...

CVE-2016-4785: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

CVE-2016-4784: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

Siemens SIPROTEC Information Disclosure Vulnerabilities (Update B)

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Siemens Equipment : SIPROTEC 4 and SIPROTEC Compact Vulnerabilities : Information Exposure 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-16-140-02...

PT-2015-3361

Name of the Vulnerable Software and Affected Versions DIGSI 4 versions prior to V4.92 EN100 Ethernet module DNP3 variant versions prior to V1.05.00 EN100 Ethernet module IEC 104 variant all versions EN100 Ethernet module IEC 61850 variant versions prior to V4.30 EN100 Ethernet module Modbus TCP...

PT-2015-3360

Name of the Vulnerable Software and Affected Versions EN100 Ethernet module IEC 61850 variant versions prior to V4.30 EN100 Ethernet module DNP3 variant versions prior to V1.04 EN100 Ethernet module PROFINET IO variant all versions EN100 Ethernet module Modbus TCP variant all versions EN100...

PT-2018-05: Unauthorized Firmware Modification in Siemens EN100 Ethernet modules

The specialists of the Positive Research center have detected an Unauthorized Firmware Modification vulnerability in Siemens EN100 Ethernet modules. Vulnerability allows unauthenticated attackers to upgrade or downgrade the firmware of the affected device including to older versions with known...

PT-2018-03: Control Takeover in Siemens DIGSI 4 and EN100 Ethernet modules

The specialists of the Positive Research center have detected a Control Takeover vulnerability in Siemens DIGSI 4 and EN100 Ethernet modules. Vulnerability allows unauthenticated remote, low-skilled attackers to upload a modified device configuration overwriting access authorization passwords, an...