PT-2016-6138 · Siemens · Siprotec Merging Unit 6Mu80+4

Aleksandr Bersenev + 1 · Publicado 2016-05-31 · Atualizado 2018-03-23 · CVE-2016-4784

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions EN100 Ethernet module firmware variant PROFINET IO versions prior to V1.04.01 EN100 Ethernet module firmware variant Modbus TCP versions prior to V1.11.00 EN100 Ethernet module firmware variant DNP3 TCP versions prior to V1.03 EN100 Ethernet module firmware variant IEC 104 versions prior to V1.21 EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 versions prior to 1.02.02 SIPROTEC 7SJ686 versions prior to V 4.83 SIPROTEC 7UT686 versions prior to V 4.01 SIPROTEC 7SD686 versions prior to V 4.03 SIPROTEC 7SJ66 versions prior to V 4.20

Description A vulnerability has been identified that could allow remote attackers to obtain sensitive device information if network access is obtained. This issue affects the integrated web server of the affected devices, specifically on port 80/tcp.

Recommendations For EN100 Ethernet module firmware variant PROFINET IO versions prior to V1.04.01, update to version V1.04.01 or later. For EN100 Ethernet module firmware variant Modbus TCP versions prior to V1.11.00, update to version V1.11.00 or later. For EN100 Ethernet module firmware variant DNP3 TCP versions prior to V1.03, update to version V1.03 or later. For EN100 Ethernet module firmware variant IEC 104 versions prior to V1.21, update to version V1.21 or later. For EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 versions prior to 1.02.02, update to version 1.02.02 or later. For SIPROTEC 7SJ686 versions prior to V 4.83, update to version V 4.83 or later. For SIPROTEC 7UT686 versions prior to V 4.01, update to version V 4.01 or later. For SIPROTEC 7SD686 versions prior to V 4.03, update to version V 4.03 or later. For SIPROTEC 7SJ66 versions prior to V 4.20, update to version V 4.20 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-4784

Produtos afetados

En100 Ethernet Module

Siprotec 7Sd686

Siprotec 7Sj66

Siprotec 7Ut686

Siprotec Merging Unit 6Mu80

Referências · 8

• http://securityfocus.com/bid/99471 · Nota
• https://osv.dev/vulnerability/CVE-2016-4784 · Aviso do Fabricante
• http://securityfocus.com/bid/90773 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-16-140-02 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4784 · Nota de Segurança
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-547990.pdf · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03 · Nota
• https://siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf · Nota