CVE-2016-4785 — Sensitive Information Exposure

Vendor	Product	Version range	Fixed in
siemens	siprotec_firmware	—	—

CISA ICS

Siemens SIPROTEC 4 and SIPROTEC Compact (Update F)

cisa_ics·2018-01-04

Siemens SIPROTEC 4 and SIPROTEC Compact (Update F) ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens SIPROTEC 4 and SIPROTEC Compact (Update F) Last RevisedMarch 20, 2018 Alert CodeICSA-17-187-03F ## CVSS v3 8.6 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SIPROTEC 4 and SIPROTEC Compact Vulnerabilities: Improper Input Validation, Missing Authorization, Improper Authentication ## UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-17-187-03E Siemens SIPROTEC 4 and SIPROTEC Compact that was published January 4, 2018, on the NCCIC/ICS-CERT website. ## AFFECTED PRODUCTS Siemens reports

CISA ICS

Siemens SWT3000

cisa_ics·2017-11-30

Siemens SWT3000 ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens SWT3000 Last RevisedNovember 30, 2017 Alert CodeICSA-17-334-01 ## CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: SWT3000 Vulnerabilities: Improper Authentication, Authentication Bypass, Improper Input Validation. ## AFFECTED PRODUCTS Siemens reports that the vulnerabilities affect the following SWT 3000 Teleprotection system products: - EN100 for SWT3000 (iSWT3000): - IEC 61850 firmware: All versions prior to V4.29.01 - TPOP firmware: All versions prior to V01.01.00 ## IMPACT Successful exploitation of these v

CISA ICS

Siemens Reyrolle

cisa_ics·2017-07-06

Siemens Reyrolle ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens Reyrolle Last RevisedJuly 06, 2017 Alert CodeICSA-17-187-02 ## CVSS v3 7.5 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Siemens Equipment: Reyrolle Vulnerabilities: Missing Authorization, Improper Input Validation, Improper Authentication ## AFFECTED PRODUCTS Siemens reports that the vulnerabilities affect the following Reyrolle integration, control, measurement, and automation products: - EN100 Ethernet modules as optional for Reyrolle: All versions prior to V4.29.01 ## IMPACT Successful exploitation of these vulnerabilities could allow an

CISA ICS

Siemens SIPROTEC Information Disclosure Vulnerabilities (Update B)

cisa_ics·2016-07-05·CVSS 5.3

[MEDIUM] Siemens SIPROTEC Information Disclosure Vulnerabilities (Update B) ## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs. ICS Advisory ## Siemens SIPROTEC Information Disclosure Vulnerabilities (Update B) Last RevisedMay 17, 2018 Alert CodeICSA-16-140-02 ## 1. EXECUTIVE SUMMARY - CVSS v3 5.3 - ATTENTION: Exploitable remotely/low skill level to exploit - Vendor: Siemens - Equipment: SIPROTEC 4 and SIPROTEC Compact - Vulnerabilities: Information Exposure ## 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-16-140-02 Siemens SIPROTEC Information Disclosure Vulnerabilities (Update A) that was published July 5, 2016, on the NCCIC/ICS-CERT website. ## 3. RISK EVALUATIO

GHSA

GHSA-q5g2-gj2v-rv2v: A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1

ghsa_unreviewed·2022-05-14

CVE-2016-4785 [MEDIUM] CWE-200 GHSA-q5g2-gj2v-rv2v: A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1 A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC Compact devices.

CVE-2016-4785: A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100…

Affected

CVSS provenance