Riskcovery

CVE-2018-4840

State
Published
Severity
Not scored
Published
Mar 8, 2018
Updated
Aug 5, 2024
Reserved
Jan 2, 2018

Read the record on cve.org

Description

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords.

Scores

The record has no CVSS score.

Weaknesses

  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
DIGSI 4Siemens
  • All versions < V4.92Affected
EN100 Ethernet module DNP3 variantSiemens
  • All versions < V1.05.00Affected
EN100 Ethernet module IEC 104 variantSiemens
  • All versionsAffected
EN100 Ethernet module IEC 61850 variantSiemens
  • All versions < V4.30Affected
EN100 Ethernet module Modbus TCP variantSiemens
  • All versionsAffected
EN100 Ethernet module PROFINET IO variantSiemens
  • All versionsAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.