SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-887113111] Siemens Reyrolle

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2017-07-06OtherSiemensSiemens reported these vulnerabilities to ICS-CERT when they made firmware available to fix them. N/ACVE-2016-4784 CVE-2016-4785 CVE-2016-7112 CVE-2016-7113 CVE-2016N/AN/AN/A

Source

						
							
								
#
# Siemens Reyrolle
#


### VULNERABLE VENDOR
Siemens


### VULNERABLE PRODUCT
Reyrolle



### RESEARCHER
Siemens reported these vulnerabilities to ICS-CERT when they made firmware available to fix them.



### AFFECTED PRODUCTS

Siemens reports that the vulnerabilities affect the following Reyrolle integration, control, measurement, and automation products:

EN100 Ethernet modules as optional for Reyrolle: All versions prior to V4.29.01



### IMPACT

Successful exploitation of these vulnerabilities could allow an attacker to access sensitive device information, circumvent authentication, and perform administrative actions.



### VULNERABILITY OVERVIEW

MISSING AUTHORIZATION CWE-862
The integrated web server (Port 80/TCP) of the affected devices could allow remote attackers to obtain sensitive device information if network access was obtained.
CVE-2016-4784 has been assigned to this vulnerability.
A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)


MISSING AUTHORIZATION CWE-862
The integrated web server (Port 80/TCP) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if network access was obtained.
CVE-2016-4785 has been assigned to this vulnerability.
A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)


MISSING AUTHORIZATION CWE-862
Attackers with network access to the device's web interface (Port 80/TCP) could possibly circumvent authentication and perform certain administrative operations.
CVE-2016-7112 has been assigned to this vulnerability.
A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)


IMPROPER INPUT VALIDATION CWE-20
Specially crafted packets sent to Port 80/TCP could cause the affected device to go into defect mode.
CVE-2016-7113 has been assigned to this vulnerability.
A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)


IMPROPER AUTHENTICATION CWE-287
Attackers with network access to the device's web interface (Port 80/TCP) could possibly circumvent authentication and perform certain administrative operations.
A legitimate user must be logged into the web interface for the attack to be successful.
CVE-2016-7114 has been assigned to this vulnerability.
A CVSS v3 base score of 4.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)





### BACKGROUND

Critical Infrastructure Sector: Energy
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany




### MITIGATION

Siemens has released a new firmware version (V4.29.01) to address these vulnerabilities. It can be found at the SIPROTEC 4 downloads area at the following Siemens web site:

http://www.siemens.com/downloads/siprotec-4


Siemens recommends users protect network access with appropriate mechanisms such as firewalls, segmentation, and VPN. Siemens also advises that users configure the operational environment according to Siemens' Operational Guidelines for Industrial Security. Please see the specific product manual for more information. Manuals can be obtained from the downloads menu at the following Siemens web site:

http://www.siemens.com/gridsecurity


For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security Advisory SSA-452237 at the following location:

http://www.siemens.com/cert/advisories