CVE-2018-4838 : A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (

A vulnerability has been identified in EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module DNP3 variant (All versions < V1.04), EN100 Ethernet module PROFINET IO variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions < V1.22). The web interface (TCP/80) of affected devices allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities.

Published 2018-03-08 17:29:00

Updated 2019-10-03 00:03:26

Source Siemens AG

View at NVD, CVE.org

Products affected by CVE-2018-4838

Siemens » En100 Ethernet Module Iec 104 Firmware » Version: N/A
cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » En100 Ethernet Module Iec 104 » Version: N/A
Siemens » En100 Ethernet Module Dnp3 Firmware » Version: N/A
cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » En100 Ethernet Module Dnp3 » Version: N/A
Siemens » En100 Ethernet Module Modbus Tcp Firmware » Version: N/A
cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » En100 Ethernet Module Modbus Tcp » Version: N/A
Siemens » En100 Ethernet Module Profinet Io Firmware » Version: N/A
cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » En100 Ethernet Module Profinet Io » Version: N/A
Siemens » En100 Ethernet Module Iec 61850 Firmware
Versions before (<) 4.30
cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » En100 Ethernet Module Iec 61850 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-4838

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 39 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-4838

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2018-4838

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-4838

https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01

Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module (Update C) | CISA
Third Party Advisory;US Government Resource

CVEs referencing this url
https://www.securityfocus.com/bid/103379

Multiple Siemens EN100 Ethernet Modules CVE-2018-4838 Authentication Bypass Vulnerability
https://cert-portal.siemens.com/productcert/pdf/ssa-845879.pdf

Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-4838

Products affected by CVE-2018-4838

Exploit prediction scoring system (EPSS) score for CVE-2018-4838

CVSS scores for CVE-2018-4838

CWE ids for CVE-2018-4838

References for CVE-2018-4838