Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-4785

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC Compact devices.

Published

2016-05-31T01:59:14.227

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 5.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Hardware siemens siprotec_4_en100 - No
Hardware siemens siprotec_compact_model - No
Operating System siemens siprotec_firmware 4.26 Yes
Hardware siemens siprotec_compact_model_7rw80 - No
Hardware siemens siprotec_compact_model_7sd80 - No
Hardware siemens siprotec_compact_model_7sj80 - No
Hardware siemens siprotec_compact_model_7sj81 - No
Hardware siemens siprotec_compact_model_7sk80 - No
Hardware siemens siprotec_compact_model_7sk81 - No
Operating System siemens siprotec_firmware - Yes
References