PT-2016-7670 · Siemens · Desigo Px+1

Joshua Fried + 2 · Publicado 2016-12-23 · Atualizado 2019-10-09 · CVE-2016-9154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D versions prior to V6.00.046 Siemens Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U versions prior to V6.00.046

Description The issue is related to the use of a pseudo random number generator with insufficient entropy to generate certificates for HTTPS. This could potentially allow remote attackers to reconstruct the corresponding private key.

Recommendations For versions prior to V6.00.046, update the firmware to version V6.00.046 or later to address the issue. As a temporary workaround, consider restricting access to the HTTPS interface until the update is applied.

Correção

Enumeração de Fraquezas

CWE-332

Identificadores relacionados

CVE-2016-9154

Produtos afetados

Desigo Px

Desigo Px Web

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-9154 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9154 · Aviso do Fabricante
• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf · Aviso do Fabricante
• http://securityfocus.com/bid/94962 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01 · Nota