Vulnerability in Siemens Digsi 4
CVE-2018-4839
A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (45.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- Siemens Digsi 4 — versions All versions < V4.92
- Siemens Digsi 4
- Siemens En100 Ethernet Module Dnp3
- Siemens En100 Ethernet Module Dnp3 Firmware
- Siemens En100 Ethernet Module Dnp3 Variant — versions All versions < V1.05.00
- Siemens En100 Ethernet Module Iec 104
- Siemens En100 Ethernet Module Iec 104 Firmware
- Siemens En100 Ethernet Module Iec 104 Variant — versions All versions
- Siemens En100 Ethernet Module Iec 61850
- Siemens En100 Ethernet Module Iec 61850 Firmware
Weakness classification (CWE)
References
- cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf (Patch, Vendor Advisory)
- ics-cert.us-cert.gov/advisories/ICSA-18-067-01 (Third Party Advisory, US Government Resource)
Frequently asked questions
- What is CVE-2018-4839?
- CVE-2018-4839 is a medium-severity vulnerability in Siemens Digsi 4, classified under Inadequate Encryption Strength. CVSS score: 5.3/10. Published 2018-03-08.
- How severe is CVE-2018-4839?
- Medium severity. CVSS v3 base score is 5.3 out of 10.