SB2018030904 - Multiple vulnerabilities in Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module
Published: March 9, 2018
Security Bulletin ID
SB2018030904
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Security restrictions bypass (CVE-ID: CVE-2018-4839)
CWE-ID: CWE-326 - Inadequate Encryption Strength
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to inadequate encryption strength. A remote attacker with local access to the engineering system or in a privileged network position can capture certain network traffic, and possibly reconstruct access authorization passwords.
2) Security restrictions bypass (CVE-ID: CVE-2018-4840)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to missing authentication for critical function. A remote attacker can upload a modified device configuration, and overwrite access authorization passwords.
3) Security restrictions bypass (CVE-ID: CVE-2018-4838)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to missing authentication for critical function. A remote attacker can upgrade or downgrade the firmware of the device, including downgrading to older versions with known vulnerabilities.
Remediation
Install update from vendor's website.