What is CVE-2016-9154?

CVE-2016-9154 is a high-severity vulnerability in Siemens Desigo Web Module Pxa30-W0, classified under CWE-332. CVSS score: 7.5/10. Published 2016-12-23.

How severe is CVE-2016-9154?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Siemens Desigo Web Module Pxa30-W0

CVE-2016-9154

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

Published 2016-12-23 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.015 (73.8th percentile), scored 2026-10-19.

Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000

Affected products

Weakness classification (CWE)

CWE-332

References

www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf (Mitigation, Vendor Advisory)
www.securityfocus.com/bid/94962 (VDB Entry, Third Party Advisory, vdb-entry)
ics-cert.us-cert.gov/advisories/ICSA-16-355-01 (US Government Resource, Third Party Advisory)

Frequently asked questions

What is CVE-2016-9154?: CVE-2016-9154 is a high-severity vulnerability in Siemens Desigo Web Module Pxa30-W0, classified under CWE-332. CVSS score: 7.5/10. Published 2016-12-23.
How severe is CVE-2016-9154?: High severity. CVSS v3 base score is 7.5 out of 10.