CVE-2017-12737
published 2017-11-15CVE-2017-12737: An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated…
PriorityP432medium5.3CVSS 3.0
AVNACLPRNUINSUCLINAN
EPSS
1.74%
74.9th percentile
An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow unauthenticated remote attackers to obtain sensitive device information over the network.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | sm-2556_firmware | — | — |
| siemens | sm-2556_firmware | — | — |
| siemens | sm-2556_firmware | — | — |
| siemens | sm-2556_firmware | — | — |
| siemens | sm-2556_firmware | — | — |
| siemens | sm-2556_firmware | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SICAM
cisa_ics·2017-11-16
Siemens SICAM
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SICAM
Last RevisedNovember 16, 2017
Alert CodeICSA-17-320-02
## CVSS v3 9.8
ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available.
Vendor: Siemens
Equipment: SICAM
Vulnerabilities: Missing Authentication for Critical Function, Cross-site Scripting, Code Injection
## AFFECTED PRODUCTS
Siemens reports that the vulnerabilities affect the following SICAM products:
- SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, DNPi00: All versions.
## IMPACT
Successful exploitation of these vulnera
GHSA
GHSA-mp48-5296-pcmp: An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00
ghsa_unreviewed·2022-05-17
CVE-2017-12737 [MEDIUM] CWE-200 GHSA-mp48-5296-pcmp: An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00
An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow unauthenticated remote attackers to obtain sensitive device information over the network.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2017-11-15
Published