All the vulnerabilites related to Siemens - DIGSI 4
var-201807-2193
Vulnerability from variot
A vulnerability has been identified in IEC 61850 system configurator (All versions < V5.80), DIGSI 5 (affected as IEC 61850 system configurator is incorporated) (All versions < V7.80), DIGSI 4 (All versions < V4.93), SICAM PAS/PQS (All versions < V8.11), SICAM PQ Analyzer (All versions < V3.11), SICAM SCC (All versions < V9.02 HF3). A service of the affected products listening on all of the host's network interfaces on either port 4884/TCP, 5885/TCP, or port 5886/TCP could allow an attacker to either exfiltrate limited data from the system or to execute code with Microsoft Windows user permissions. Successful exploitation requires an attacker to be able to send a specially crafted network request to the vulnerable service and a user interacting with the service's client application on the host. In order to execute arbitrary code with Microsoft Windows user permissions, an attacker must be able to plant the code in advance on the host by other means. The vulnerability has limited impact to confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue. plural Siemens The product contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens IEC 61850 system configurator and so on are the products of German Siemens. Siemens IEC 61850 system configurator is a system configurator for smart substations; DIGSI is a unified configuration software for Siemens protection and measurement and control systems.
There are security holes in several Siemens products. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201807-2193",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "sicam pq analyzer",
"scope": "lt",
"trust": 1.8,
"vendor": "siemens",
"version": "3.11"
},
{
"model": "digsi 4",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "sicam scc",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "ec 61850 system configurator",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "5.80"
},
{
"model": "digsi 5",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "7.80"
},
{
"model": "sicam pas\\/pqs",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "8.11"
},
{
"model": "digsi 4",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "digsi 5",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "iec 61850 system configurator",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "5.80"
},
{
"model": "sicam pas/pqs",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "8.11"
},
{
"model": "sicam scc",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "iec system configurator",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "61850\u003cv5.80"
},
{
"model": "digsi",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "561850\u003cv7.80"
},
{
"model": "digsi",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "4\u003cv4.93"
},
{
"model": "sicam pas/pqs",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "v8.11"
},
{
"model": "sicam pq analyzer",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "v3.11"
},
{
"model": "sicam scc hf3",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "v9.02"
},
{
"model": "sicam scc",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "9.0"
},
{
"model": "sicam pqs",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.10"
},
{
"model": "sicam pq analyzer",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "3.10"
},
{
"model": "sicam pas",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.10"
},
{
"model": "sicam pas",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.08"
},
{
"model": "sicam pas",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.07"
},
{
"model": "sicam pas",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "8.00"
},
{
"model": "sicam pas",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "6.0"
},
{
"model": "iec system configurator",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "618504.0"
},
{
"model": "digsi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "57.0"
},
{
"model": "digsi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "44.92"
},
{
"model": "sicam scc hf3",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "9.02"
},
{
"model": "sicam pqs",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "8.11"
},
{
"model": "sicam pq analyzer",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "3.11"
},
{
"model": "sicam pas",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "8.11"
},
{
"model": "iec system configurator",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "618505.80"
},
{
"model": "digsi",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "57.80"
},
{
"model": "digsi",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.93"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ec 61850 system configurator",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sicam pas pqs",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sicam pq analyzer",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "sicam scc",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "digsi 4",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "digsi 5",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "BID",
"id": "105933"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:ec_61850_system_configurator_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.80",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:ec_61850_system_configurator:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sicam_pq_analyzer_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.11",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sicam_pq_analyzer:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:sicam_scc_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:sicam_scc:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:digsi_4_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:digsi_4:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:digsi_5_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "7.80",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:digsi_5:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:sicam_pas\\/pqs:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "8.11",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4858"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "105933"
}
],
"trust": 0.3
},
"cve": "CVE-2018-4858",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2018-4858",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2020-02201",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-134889",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-4858",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-4858",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2020-02201",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201807-480",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-134889",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "VULHUB",
"id": "VHN-134889"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in IEC 61850 system configurator (All versions \u003c V5.80), DIGSI 5 (affected as IEC 61850 system configurator is incorporated) (All versions \u003c V7.80), DIGSI 4 (All versions \u003c V4.93), SICAM PAS/PQS (All versions \u003c V8.11), SICAM PQ Analyzer (All versions \u003c V3.11), SICAM SCC (All versions \u003c V9.02 HF3). A service of the affected products listening on all of the host\u0027s network interfaces on either port 4884/TCP, 5885/TCP, or port 5886/TCP could allow an attacker to either exfiltrate limited data from the system or to execute code with Microsoft Windows user permissions. Successful exploitation requires an attacker to be able to send a specially crafted network request to the vulnerable service and a user interacting with the service\u0027s client application on the host. In order to execute arbitrary code with Microsoft Windows user permissions, an attacker must be able to plant the code in advance on the host by other means. The vulnerability has limited impact to confidentiality and integrity of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue. plural Siemens The product contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens IEC 61850 system configurator and so on are the products of German Siemens. Siemens IEC 61850 system configurator is a system configurator for smart substations; DIGSI is a unified configuration software for Siemens protection and measurement and control systems. \n\nThere are security holes in several Siemens products. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "BID",
"id": "105933"
},
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "VULHUB",
"id": "VHN-134889"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4858",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-18-317-01",
"trust": 2.8
},
{
"db": "BID",
"id": "105933",
"trust": 2.6
},
{
"db": "SIEMENS",
"id": "SSA-159860",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2020-02201",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212",
"trust": 0.8
},
{
"db": "IVD",
"id": "0CC7FCFD-B25F-456E-8B03-2034EC5B8A7E",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-98851",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-134889",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "VULHUB",
"id": "VHN-134889"
},
{
"db": "BID",
"id": "105933"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"id": "VAR-201807-2193",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "VULHUB",
"id": "VHN-134889"
}
],
"trust": 1.583262806
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
}
]
},
"last_update_date": "2023-12-18T13:43:38.897000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-159860",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-159860.pdf"
},
{
"title": "Patch for Multiple Siemens Product Access Bypass Vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/197073"
},
{
"title": "Multiple Siemens Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84011"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-284",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134889"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "NVD",
"id": "CVE-2018-4858"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-317-01"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/105933"
},
{
"trust": 1.7,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-159860.pdf"
},
{
"trust": 1.4,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4858"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4858"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "VULHUB",
"id": "VHN-134889"
},
{
"db": "BID",
"id": "105933"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"db": "VULHUB",
"id": "VHN-134889"
},
{
"db": "BID",
"id": "105933"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-01-14T00:00:00",
"db": "IVD",
"id": "0cc7fcfd-b25f-456e-8b03-2034ec5b8a7e"
},
{
"date": "2020-01-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"date": "2018-07-09T00:00:00",
"db": "VULHUB",
"id": "VHN-134889"
},
{
"date": "2018-11-15T00:00:00",
"db": "BID",
"id": "105933"
},
{
"date": "2018-10-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"date": "2018-07-09T19:29:00.407000",
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"date": "2018-07-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-01-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-02201"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-134889"
},
{
"date": "2018-11-15T00:00:00",
"db": "BID",
"id": "105933"
},
{
"date": "2018-11-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-008212"
},
{
"date": "2023-10-16T13:52:15.963000",
"db": "NVD",
"id": "CVE-2018-4858"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Siemens Access control vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-008212"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201807-480"
}
],
"trust": 0.6
}
}
var-201803-2156
Vulnerability from variot
A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords. plural Siemens The product contains an authorization vulnerability.Information may be obtained. Siemens DIGSI and others are products of Siemens AG. The Siemens DIGSI is a configuration operating software for the microcomputer protection. EN100 Ethernet module The IEC 61850 variant is an Ethernet module product. Security vulnerabilities exist in several Siemens products. An attacker could exploit the vulnerability to re-establish an access authorization password
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201803-2156",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "siprotec compact 7sk80",
"scope": "lt",
"trust": 1.8,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "siprotec compact 7sj80",
"scope": "lt",
"trust": 1.8,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "en100 ethernet module modbus tcp",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec 104",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module profinet io",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module dnp3",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec compact 7sk80",
"scope": null,
"trust": 1.1,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec compact 7sj80",
"scope": null,
"trust": 1.1,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec 4 7sj66",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "digsi 4",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.92"
},
{
"model": "en100 ethernet module iec 61850",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "digsi",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "44.92"
},
{
"model": "en100 ethernet module iec variant",
"scope": "eq",
"trust": 0.8,
"vendor": "siemens",
"version": "61850\u003c4.30"
},
{
"model": "siprotec compact 7sj66",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "digsi 4",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module dnp3",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec 104",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec 61850",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module modbus tcp",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module profinet io",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec 4 7sj66",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module profinet io variant",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module modbus tcp variant",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module dnp3 variant",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec variant",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "104"
},
{
"model": "siprotec compact",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "siprotec 7sj66",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sj64",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sj62",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sj61",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sd80",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "40"
},
{
"model": "en100 ethernet module profinet io",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "en100 ethernet module modbus tcp",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "en100 ethernet module iec",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "618500"
},
{
"model": "en100 ethernet module iec",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1040"
},
{
"model": "en100 ethernet module dnp3",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "digsi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "40"
},
{
"model": "siprotec compact 7sk80",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "siprotec compact 7sj80",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "siprotec 7sj66",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.30"
},
{
"model": "siprotec 7sj64",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.96"
},
{
"model": "siprotec 7sj61",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.96"
},
{
"model": "siprotec 7sd80",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.70"
},
{
"model": "en100 ethernet module iec",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "618504.30"
},
{
"model": "en100 ethernet module dnp3",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "digsi",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.92"
},
{
"model": "en100 ethernet module profinet io variant",
"scope": "eq",
"trust": 0.2,
"vendor": "siemens",
"version": "*"
},
{
"model": "en100 ethernet module modbus tcp variant",
"scope": "eq",
"trust": 0.2,
"vendor": "siemens",
"version": "*"
},
{
"model": "en100 ethernet module dnp3 variant",
"scope": "eq",
"trust": 0.2,
"vendor": "siemens",
"version": "*"
},
{
"model": "en100 ethernet module iec variant",
"scope": "eq",
"trust": 0.2,
"vendor": "siemens",
"version": "104*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:siprotec_compact_7sj80_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.77",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:siprotec_compact_7sj80:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:siprotec_compact_7sk80_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.77",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:siprotec_compact_7sk80:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:siprotec_4_7sj66_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.30",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:siprotec_4_7sj66:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:digsi_4:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.92",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_iec_104:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_dnp3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_modbus_tcp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_profinet_io:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.30",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_iec_61850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4839"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ilya Karpov and Dmitry Sklyarov from Positive Technologies.",
"sources": [
{
"db": "BID",
"id": "107481"
}
],
"trust": 0.3
},
"cve": "CVE-2018-4839",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 3.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-4839",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "CNVD-2018-05196",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "VHN-134870",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "High",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-4839",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-4839",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-05196",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-229",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-134870",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "VULHUB",
"id": "VHN-134870"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions \u003c V4.70), SIPROTEC 4 7SJ61 (All versions \u003c V4.96), SIPROTEC 4 7SJ62 (All versions \u003c V4.96), SIPROTEC 4 7SJ64 (All versions \u003c V4.96), SIPROTEC 4 7SJ66 (All versions \u003c V4.30), SIPROTEC Compact 7SJ80 (All versions \u003c V4.77), SIPROTEC Compact 7SK80 (All versions \u003c V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords. plural Siemens The product contains an authorization vulnerability.Information may be obtained. Siemens DIGSI and others are products of Siemens AG. The Siemens DIGSI is a configuration operating software for the microcomputer protection. EN100 Ethernet module The IEC 61850 variant is an Ethernet module product. Security vulnerabilities exist in several Siemens products. An attacker could exploit the vulnerability to re-establish an access authorization password",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-134870"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4839",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-18-067-01",
"trust": 3.0
},
{
"db": "SIEMENS",
"id": "SSA-203306",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2018-05196",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720",
"trust": 0.8
},
{
"db": "BID",
"id": "107481",
"trust": 0.3
},
{
"db": "IVD",
"id": "E2E5E9A1-39AB-11E9-9407-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-134870",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "VULHUB",
"id": "VHN-134870"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"id": "VAR-201803-2156",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "VULHUB",
"id": "VHN-134870"
}
],
"trust": 1.6392756275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
}
]
},
"last_update_date": "2023-12-18T13:28:58.747000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-203306",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
},
{
"title": "Patches for unidentified vulnerabilities in various Siemens products",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/121391"
},
{
"title": "Multiple Siemens Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=78965"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-326",
"trust": 1.1
},
{
"problemtype": "CWE-285",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134870"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "NVD",
"id": "CVE-2018-4839"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-067-01"
},
{
"trust": 2.0,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4839"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4839"
},
{
"trust": 0.3,
"url": "http://w3.siemens.com/smartgrid/global/en/products-systems-solutions/protection/siprotec4/pages/overview.aspx"
},
{
"trust": 0.3,
"url": "http://w3.siemens.com/smartgrid/global/en/products-systems-solutions/protection/siprotec-compact/pages/overview.aspx"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "VULHUB",
"id": "VHN-134870"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"db": "VULHUB",
"id": "VHN-134870"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-14T00:00:00",
"db": "IVD",
"id": "e2e5e9a1-39ab-11e9-9407-000c29342cb1"
},
{
"date": "2018-03-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"date": "2018-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-134870"
},
{
"date": "2018-03-08T00:00:00",
"db": "BID",
"id": "107481"
},
{
"date": "2018-04-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"date": "2018-03-08T17:29:00.257000",
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"date": "2018-03-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05196"
},
{
"date": "2021-07-13T00:00:00",
"db": "VULHUB",
"id": "VHN-134870"
},
{
"date": "2018-03-08T00:00:00",
"db": "BID",
"id": "107481"
},
{
"date": "2018-04-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-002720"
},
{
"date": "2021-07-13T12:15:08.987000",
"db": "NVD",
"id": "CVE-2018-4839"
},
{
"date": "2021-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Siemens Authorization vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-002720"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-229"
}
],
"trust": 0.6
}
}
var-201803-2157
Vulnerability from variot
A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords. plural Siemens The product contains an access control vulnerability.Information may be tampered with. SiemensDIGSI and others are products of Siemens AG. SiemensDIGSI is a configuration operating software for a microcomputer protection device. A security vulnerability exists in several Siemens products that stems from a program failing to authenticate important features. Siemens DIGSI, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201803-2157",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "en100 ethernet module modbus tcp",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec 104",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module profinet io",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module dnp3",
"scope": "eq",
"trust": 1.6,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec 4 7sj66",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "siprotec compact 7sj80",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "siprotec compact 7sk80",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "digsi 4",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.92"
},
{
"model": "en100 ethernet module iec 61850",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "digsi 4",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module dnp3",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec 104",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec 61850",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module modbus tcp",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module profinet io",
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": "digsi",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "44.92"
},
{
"model": "en100 ethernet module iec variant",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "61850\u003c4.30"
},
{
"model": "en100 ethernet module profinet io variant",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module modbus tcp variant",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module dnp3 variant",
"scope": null,
"trust": 0.6,
"vendor": "siemens",
"version": null
},
{
"model": "en100 ethernet module iec variant",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "104"
},
{
"model": "siprotec compact 7sk80",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec compact 7sj80",
"scope": null,
"trust": 0.3,
"vendor": "siemens",
"version": null
},
{
"model": "siprotec compact",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "siprotec 7sj66",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sj64",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sj62",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sj61",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec 7sd80",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "4"
},
{
"model": "siprotec",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "40"
},
{
"model": "en100 ethernet module profinet io",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "en100 ethernet module modbus tcp",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "en100 ethernet module iec",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "618500"
},
{
"model": "en100 ethernet module iec",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "1040"
},
{
"model": "en100 ethernet module dnp3",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "digsi",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "40"
},
{
"model": "siprotec compact 7sk80",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "siprotec compact 7sj80",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "4.77"
},
{
"model": "siprotec 7sj66",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.30"
},
{
"model": "siprotec 7sj64",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.96"
},
{
"model": "siprotec 7sj61",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.96"
},
{
"model": "siprotec 7sd80",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.70"
},
{
"model": "en100 ethernet module iec",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "618504.30"
},
{
"model": "en100 ethernet module dnp3",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "4.30"
},
{
"model": "digsi",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "44.92"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "siprotec compact 7sj80",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "siprotec compact 7sk80",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "siprotec 4 7sj66",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "digsi 4",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "en100 ethernet module iec 104",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "en100 ethernet module dnp3",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "en100 ethernet module modbus tcp",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "en100 ethernet module profinet io",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "en100 ethernet module iec 61850",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:siprotec_compact_7sj80_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.77",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:siprotec_compact_7sj80:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:siprotec_compact_7sk80_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.77",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:siprotec_compact_7sk80:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:siprotec_4_7sj66_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.30",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:siprotec_4_7sj66:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:digsi_4:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.92",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_iec_104:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_dnp3:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_modbus_tcp:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_profinet_io:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.30",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:siemens:en100_ethernet_module_iec_61850:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4840"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ilya Karpov and Dmitry Sklyarov from Positive Technologies.",
"sources": [
{
"db": "BID",
"id": "107481"
}
],
"trust": 0.3
},
"cve": "CVE-2018-4840",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-4840",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-05156",
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1",
"impactScore": 6.9,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-134871",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-4840",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-4840",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-05156",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-228",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-134871",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "VULHUB",
"id": "VHN-134871"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords. plural Siemens The product contains an access control vulnerability.Information may be tampered with. SiemensDIGSI and others are products of Siemens AG. SiemensDIGSI is a configuration operating software for a microcomputer protection device. A security vulnerability exists in several Siemens products that stems from a program failing to authenticate important features. Siemens DIGSI, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-134871"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4840",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-18-067-01",
"trust": 3.0
},
{
"db": "SIEMENS",
"id": "SSA-203306",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2018-05156",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721",
"trust": 0.8
},
{
"db": "BID",
"id": "107481",
"trust": 0.3
},
{
"db": "IVD",
"id": "E2E54D62-39AB-11E9-854B-000C29342CB1",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-134871",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "VULHUB",
"id": "VHN-134871"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"id": "VAR-201803-2157",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "VULHUB",
"id": "VHN-134871"
}
],
"trust": 1.6392756275
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
}
]
},
"last_update_date": "2023-12-18T13:28:58.785000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-203306",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
},
{
"title": "Siemens multiple product file upload vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/121353"
},
{
"title": "Multiple Siemens Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=78964"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-306",
"trust": 1.1
},
{
"problemtype": "CWE-284",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134871"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "NVD",
"id": "CVE-2018-4840"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-067-01"
},
{
"trust": 2.0,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4840"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4840"
},
{
"trust": 0.3,
"url": "http://w3.siemens.com/smartgrid/global/en/products-systems-solutions/protection/siprotec4/pages/overview.aspx"
},
{
"trust": 0.3,
"url": "http://w3.siemens.com/smartgrid/global/en/products-systems-solutions/protection/siprotec-compact/pages/overview.aspx"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "VULHUB",
"id": "VHN-134871"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"db": "VULHUB",
"id": "VHN-134871"
},
{
"db": "BID",
"id": "107481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-13T00:00:00",
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"date": "2018-03-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"date": "2018-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-134871"
},
{
"date": "2018-03-08T00:00:00",
"db": "BID",
"id": "107481"
},
{
"date": "2018-04-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"date": "2018-03-08T17:29:00.307000",
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"date": "2018-03-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-13T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-05156"
},
{
"date": "2021-07-13T00:00:00",
"db": "VULHUB",
"id": "VHN-134871"
},
{
"date": "2018-03-08T00:00:00",
"db": "BID",
"id": "107481"
},
{
"date": "2018-04-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-002721"
},
{
"date": "2021-07-13T12:15:09.093000",
"db": "NVD",
"id": "CVE-2018-4840"
},
{
"date": "2021-07-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Siemens Multiple Product File Upload Vulnerabilities",
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-05156"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Access control error",
"sources": [
{
"db": "IVD",
"id": "e2e54d62-39ab-11e9-854b-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-228"
}
],
"trust": 0.8
}
}
var-202102-0297
Vulnerability from variot
A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM. DIGSI 4 Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. DIGSI 4 is the operation and configuration software for SIPROTEC 4 and SIPROTEC compact protection devices.
Siemens DIGSI 4 has a privilege escalation vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202102-0297",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "digsi 4",
"scope": "eq",
"trust": 1.0,
"vendor": "siemens",
"version": "4.94"
},
{
"model": "digsi 4",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "4.94"
},
{
"model": "digsi 4",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": null
},
{
"model": "digsi 4",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9",
"version": "4.94 sp1 hf 1"
},
{
"model": "digsi sp1 hf",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "4\u003cv4.941"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "NVD",
"id": "CVE-2020-25245"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:digsi_4:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.94",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:digsi_4:4.94:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:siemens:digsi_4:4.94:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25245"
}
]
},
"cve": "CVE-2020-25245",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.2,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2020-25245",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2021-11832",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2020-25245",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-25245",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2021-11832",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202102-879",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM. DIGSI 4 Is vulnerable to incorrect default permissions.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. DIGSI 4 is the operation and configuration software for SIPROTEC 4 and SIPROTEC compact protection devices. \n\r\n\r\nSiemens DIGSI 4 has a privilege escalation vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "CNVD",
"id": "CNVD-2021-11832"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-25245",
"trust": 3.0
},
{
"db": "ICS CERT",
"id": "ICSA-21-040-10",
"trust": 2.4
},
{
"db": "SIEMENS",
"id": "SSA-536315",
"trust": 2.2
},
{
"db": "JVN",
"id": "JVNVU91083521",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2021-11832",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.0504",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202102-879",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"id": "VAR-202102-0297",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
}
],
"trust": 1.4382353
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
}
]
},
"last_update_date": "2023-12-18T11:16:09.815000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-536315",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf"
},
{
"title": "Patch for Siemens DIGSI 4 Privilege Escalation Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/248786"
},
{
"title": "DIGSI 4 Fixes for permissions and access control issues vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=142605"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-276",
"trust": 1.0
},
{
"problemtype": "Inappropriate default permissions (CWE-276) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "NVD",
"id": "CVE-2020-25245"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10"
},
{
"trust": 2.2,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu91083521"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-25245"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.0504"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"date": "2021-10-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"date": "2021-02-09T17:15:13.687000",
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"date": "2021-02-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-04-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2021-11832"
},
{
"date": "2021-10-29T08:04:00",
"db": "JVNDB",
"id": "JVNDB-2020-015982"
},
{
"date": "2021-02-25T19:59:14.667000",
"db": "NVD",
"id": "CVE-2020-25245"
},
{
"date": "2021-03-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "DIGSI\u00a04\u00a0 Inappropriate Default Permission Vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-015982"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202102-879"
}
],
"trust": 0.6
}
}
cve-2018-4839
Vulnerability from cvelistv5
Published
2018-03-08 17:00
Modified
2024-08-05 05:18
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.
References
| ▼ | URL | Tags |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Siemens | DIGSI 4 |
Version: All versions < V4.92 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T05:18:26.659Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIGSI 4",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.92"
}
]
},
{
"product": "EN100 Ethernet module DNP3 variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V1.05.00"
}
]
},
{
"product": "EN100 Ethernet module IEC 104 variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "EN100 Ethernet module IEC 61850 variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.30"
}
]
},
{
"product": "EN100 Ethernet module Modbus TCP variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "EN100 Ethernet module PROFINET IO variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "Other SIPROTEC 4 relays",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "Other SIPROTEC Compact relays",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "SIPROTEC 4 7SD80",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.70"
}
]
},
{
"product": "SIPROTEC 4 7SJ61",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.96"
}
]
},
{
"product": "SIPROTEC 4 7SJ62",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.96"
}
]
},
{
"product": "SIPROTEC 4 7SJ64",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.96"
}
]
},
{
"product": "SIPROTEC 4 7SJ66",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.30"
}
]
},
{
"product": "SIPROTEC Compact 7SJ80",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.77"
}
]
},
{
"product": "SIPROTEC Compact 7SK80",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.77"
}
]
}
],
"datePublic": "2018-03-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions \u003c V4.70), SIPROTEC 4 7SJ61 (All versions \u003c V4.96), SIPROTEC 4 7SJ62 (All versions \u003c V4.96), SIPROTEC 4 7SJ64 (All versions \u003c V4.96), SIPROTEC 4 7SJ66 (All versions \u003c V4.30), SIPROTEC Compact 7SJ80 (All versions \u003c V4.77), SIPROTEC Compact 7SK80 (All versions \u003c V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-326",
"description": "CWE-326: Inadequate Encryption Strength",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-13T11:02:46",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2018-4839",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIGSI 4",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.92"
}
]
}
},
{
"product_name": "EN100 Ethernet module DNP3 variant",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V1.05.00"
}
]
}
},
{
"product_name": "EN100 Ethernet module IEC 104 variant",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "EN100 Ethernet module IEC 61850 variant",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.30"
}
]
}
},
{
"product_name": "EN100 Ethernet module Modbus TCP variant",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "EN100 Ethernet module PROFINET IO variant",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "Other SIPROTEC 4 relays",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "Other SIPROTEC Compact relays",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "SIPROTEC 4 7SD80",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.70"
}
]
}
},
{
"product_name": "SIPROTEC 4 7SJ61",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.96"
}
]
}
},
{
"product_name": "SIPROTEC 4 7SJ62",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.96"
}
]
}
},
{
"product_name": "SIPROTEC 4 7SJ64",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.96"
}
]
}
},
{
"product_name": "SIPROTEC 4 7SJ66",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.30"
}
]
}
},
{
"product_name": "SIPROTEC Compact 7SJ80",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.77"
}
]
}
},
{
"product_name": "SIPROTEC Compact 7SK80",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.77"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions \u003c V4.70), SIPROTEC 4 7SJ61 (All versions \u003c V4.96), SIPROTEC 4 7SJ62 (All versions \u003c V4.96), SIPROTEC 4 7SJ64 (All versions \u003c V4.96), SIPROTEC 4 7SJ66 (All versions \u003c V4.30), SIPROTEC Compact 7SJ80 (All versions \u003c V4.77), SIPROTEC Compact 7SK80 (All versions \u003c V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-326: Inadequate Encryption Strength"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2018-4839",
"datePublished": "2018-03-08T17:00:00",
"dateReserved": "2018-01-02T00:00:00",
"dateUpdated": "2024-08-05T05:18:26.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-25245
Vulnerability from cvelistv5
Published
2021-02-09 15:38
Modified
2024-08-04 15:33
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM.
References
| ▼ | URL | Tags |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf | x_refsource_MISC | |
| https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:33:05.553Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIGSI 4",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.94 SP1 HF 1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276: Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-02-12T20:09:53",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2020-25245",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIGSI 4",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.94 SP1 HF 1"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-276: Incorrect Default Permissions"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf",
"refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2020-25245",
"datePublished": "2021-02-09T15:38:18",
"dateReserved": "2020-09-10T00:00:00",
"dateUpdated": "2024-08-04T15:33:05.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-4840
Vulnerability from cvelistv5
Published
2018-03-08 17:00
Modified
2024-08-05 05:18
Severity ?
EPSS score ?
Summary
A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords.
References
| ▼ | URL | Tags |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Siemens | DIGSI 4 |
Version: All versions < V4.92 |
||||||||||||||||||||
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T05:18:26.487Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DIGSI 4",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.92"
}
]
},
{
"product": "EN100 Ethernet module DNP3 variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V1.05.00"
}
]
},
{
"product": "EN100 Ethernet module IEC 104 variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "EN100 Ethernet module IEC 61850 variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions \u003c V4.30"
}
]
},
{
"product": "EN100 Ethernet module Modbus TCP variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"product": "EN100 Ethernet module PROFINET IO variant",
"vendor": "Siemens",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"datePublic": "2018-03-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-13T11:02:47",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2018-4840",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "DIGSI 4",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.92"
}
]
}
},
{
"product_name": "EN100 Ethernet module DNP3 variant",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V1.05.00"
}
]
}
},
{
"product_name": "EN100 Ethernet module IEC 104 variant",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "EN100 Ethernet module IEC 61850 variant",
"version": {
"version_data": [
{
"version_value": "All versions \u003c V4.30"
}
]
}
},
{
"product_name": "EN100 Ethernet module Modbus TCP variant",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
},
{
"product_name": "EN100 Ethernet module PROFINET IO variant",
"version": {
"version_data": [
{
"version_value": "All versions"
}
]
}
}
]
},
"vendor_name": "Siemens"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been identified in DIGSI 4 (All versions \u003c V4.92), EN100 Ethernet module DNP3 variant (All versions \u003c V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions \u003c V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-306: Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf",
"refsource": "CONFIRM",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2018-4840",
"datePublished": "2018-03-08T17:00:00",
"dateReserved": "2018-01-02T00:00:00",
"dateUpdated": "2024-08-05T05:18:26.487Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}