CVE-2016-7112 - OpenCVE

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Siemens	En100 Ethernet Module En100 Ethernet Module Firmware

Configuration 1 [-]

AND

cpe:2.3:a:siemens:en100_ethernet_module_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/92747
http://www.securityfocus.com/bid/99471
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf
https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-09-06T00:00:00Z

Updated: 2024-09-16T17:58:01.834Z

Reserved: 2016-08-30T00:00:00

Link: CVE-2016-7112

Vulnrichment

No data.

NVD

Status : Modified

Published: 2016-09-06T00:59:00.117

Modified: 2018-03-23T01:29:00.947

Link: CVE-2016-7112

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2017-07-04T00:00:00", "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-03-22T17:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "92747", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92747"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf"}, {"tags": ["x_refsource_MISC"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf"}, {"name": "99471", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99471"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_PUBLIC": "2017-07-04T00:00:00", "ID": "CVE-2016-7112", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "92747", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92747"}, {"name": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf", "refsource": "CONFIRM", "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf"}, {"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03", "refsource": "MISC", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03"}, {"name": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf", "refsource": "CONFIRM", "url": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf"}, {"name": "99471", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99471"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:50:47.462Z"}, "title": "CVE Program Container", "references": [{"name": "92747", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92747"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf"}, {"name": "99471", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99471"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-7112", "datePublished": "2016-09-06T00:00:00Z", "dateReserved": "2016-08-30T00:00:00", "dateUpdated": "2024-09-16T17:58:01.834Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:en100_ethernet_module_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E452C818-6183-48B7-AC0C-05C605FAFCD8", "versionEndIncluding": "4.28", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:*", "matchCriteriaId": "DAC429FD-7148-4A68-AA81-8FBADA588F4E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Attackers with network access to the device's web interface (port 80/tcp) could possibly circumvent authentication and perform certain administrative operations."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en la variante de Firmware PROFINET IO para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.04.01; la variante de Firmware Modbus TCP para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.11.00; la variante de Firmware v TCP para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.03; la variante de Firmware IEC 104 para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.21 y el m\u00f3dulo EN100 Ethernet incluido en SIPROTEC Merging Unit 6MU80: todas las versiones anteriores a la 1.02.02. Los atacantes que tengan acceso de red a la interfaz web del dispositivo (puerto 80/tcp) podr\u00edan omitir la autenticaci\u00f3n y realizar ciertas operaciones administrativas."}], "id": "CVE-2016-7112", "lastModified": "2018-03-23T01:29:00.947", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-06T00:59:00.117", "references": [{"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/92747"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/99471"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-630413.pdf"}, {"source": "cve@mitre.org", "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03"}, {"source": "cve@mitre.org", "url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}