cbcvebase.
CVE-2017-12739
published 2017-11-15

CVE-2017-12739: An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated…

PriorityP268critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
5.65%
92.0th percentile
An issue was discovered on Siemens SICAM RTUs SM-2556 COM Modules with the firmware variants ENOS00, ERAC00, ETA2, ETLS00, MODi00, and DNPi00. The integrated web server (port 80/tcp) of the affected devices could allow unauthenticated remote attackers to execute arbitrary code on the affected device.

Affected

6 ranges
VendorProductVersion rangeFixed in
siemenssm-2556_firmware——
siemenssm-2556_firmware——
siemenssm-2556_firmware——
siemenssm-2556_firmware——
siemenssm-2556_firmware——
siemenssm-2556_firmware——

Detection & IOCsextracted from sources · hover to see the quote

port80/tcp↗
  • →Target is the integrated web server on port 80/TCP of Siemens SICAM RTUs SM-2556 COM Modules; exploit requires no authentication and no user interaction (PR:N/UI:N), making unauthenticated POST/GET requests to the web server a key detection signal. ↗
  • →Public exploits are available for this vulnerability; monitor for exploit framework traffic targeting port 80/TCP on SICAM RTU devices. ↗
  • →Affected firmware variants to fingerprint on the network: ENOS00, ERAC00, ETA2, ETLS00, MODi00, DNPi00 — banner grabbing or HTTP response analysis on port 80 may reveal these identifiers. ↗
  • ·The web server on port 80/TCP is for diagnostics only and not required for normal operation; if it is observed active in production, this represents a misconfiguration and an attack surface that should be disabled. ↗
  • ·All firmware versions of the listed variants are affected; there is no patched version for SM-2556 — detection should cover all deployed units running ENOS00, ERAC00, ETA2, ETLS00, MODi00, or DNPi00. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.