Path Traversal in Siemens En100 Ethernet Module
CVE-2019-13944
A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module IEC104 variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). A vulnerability in the integrated web server of the affected devices could allow unauthorized attackers to obtain sensitive information about the device, including logs and configurations. At the time of advisory publication no public exploitation of this security vulnerability was known.
EPSS: 0.016 (73.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Siemens En100_ethernet_module
- Siemens En100_ethernet_module_with_firmware_variant_dnp3_tcp
- Siemens En100_ethernet_module_with_firmware_variant_iec104
- Siemens En100_ethernet_module_with_firmware_variant_iec_61850
- Siemens En100_ethernet_module_with_firmware_variant_modbus_tcp
- Siemens En100_ethernet_module_with_firmware_variant_profinet_io
- Siemens Ag En100 Ethernet Module Dnp3 Variant — versions All versions
- Siemens Ag En100 Ethernet Module Iec104 Variant — versions All versions
- Siemens Ag En100 Ethernet Module Iec 61850 Variant — versions All versions < V4.37
- Siemens Ag En100 Ethernet Module Modbus Tcp Variant — versions All versions
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_MISC, Vendor Advisory)
- productcert@siemens.com (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-13944?
- CVE-2019-13944 is a medium-severity vulnerability in Siemens En100 Ethernet Module, classified under Relative Path Traversal. CVSS score: 5.3/10. Published 2019-12-12.
- How severe is CVE-2019-13944?
- Medium severity. CVSS v3 base score is 5.3 out of 10.