« Volver al listado

CVE-2016-9154

Estado: ModificadaAlta (7.5)—

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Siemens — Desigo WEB Module Pxa30-w0 FirmwareSiemens — Desigo WEB Module Pxa30-w1 FirmwareSiemens — Desigo WEB Module Pxa30-w2 FirmwareSiemens — Desigo WEB Module Pxa40-w0 FirmwareSiemens — Desigo WEB Module Pxa40-w1 FirmwareSiemens — Desigo WEB Module Pxa40-w2 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-9154",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Desigo PX Web modules with all firmware versions < V6.00.046",
          "versions": [
            {
              "status": "affected",
              "version": "Desigo PX Web modules with all firmware versions < V6.00.046"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-12-23T05:59:00.593",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/94962",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/94962",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-332"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-332"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key."
    },
    {
      "lang": "es",
      "value": "Los módulos Siemens Desigo PX Web PXA40-W0, PXA40-W1, PXA40-W2 para controladores automáticos Desigo PX PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (todas las versiones de firmware < V6.00.046) y módulos web Desigo PX PXA30-W0, PXA30-W1, PXA30-W2 para controladores automáticos Desigo PX PXC00-U, PXC64-U, PXC128-U (todas las versiones de firmware < V6.00.046) utilizan un generador de números pseudoaleatorios con entropía insuficiente para generar certificados HTTPS, potencialmente permite a atacantes remotos recontruir la clave privada correspondiente."
    }
  ],
  "lastModified": "2026-06-17T00:55:35.973",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:desigo_web_module_pxa30-w0_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5C10637-A57E-4962-AB67-AE4011D2C089",
              "versionEndIncluding": "6.00.00"
            },
            {
              "criteria": "cpe:2.3:a:siemens:desigo_web_module_pxa30-w1_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6286131E-6399-48E4-919F-0190747B8E44",
              "versionEndIncluding": "6.00.00"
            },
            {
              "criteria": "cpe:2.3:a:siemens:desigo_web_module_pxa30-w2_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88E1B0C0-26EF-4D5E-AF6B-D6E0FA262DAE",
              "versionEndIncluding": "6.00.00"
            },
            {
              "criteria": "cpe:2.3:a:siemens:desigo_web_module_pxa40-w0_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE4D4A9B-806A-4B40-83A7-C94757D17438",
              "versionEndIncluding": "6.00.00"
            },
            {
              "criteria": "cpe:2.3:a:siemens:desigo_web_module_pxa40-w1_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7DA287F-D035-4938-82F6-0115D6A486DC",
              "versionEndIncluding": "6.00.00"
            },
            {
              "criteria": "cpe:2.3:a:siemens:desigo_web_module_pxa40-w2_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BFB5ABF-932D-4912-9B40-0DF467DE1BEF",
              "versionEndIncluding": "6.00.00"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:desigo_web_module_pxa30-w0:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "56BC0886-95F1-4FF1-9F91-2CBDDD1AA591"
            },
            {
              "criteria": "cpe:2.3:h:siemens:desigo_web_module_pxa30-w1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6D92AC0D-D075-49B4-B93B-B9F916FF09B3"
            },
            {
              "criteria": "cpe:2.3:h:siemens:desigo_web_module_pxa30-w2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5F827A9C-8BF8-43FE-818E-DBA46FCD6767"
            },
            {
              "criteria": "cpe:2.3:h:siemens:desigo_web_module_pxa40-w0:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5BE371AF-ECE2-4C1C-8F02-F4D984D4FFEF"
            },
            {
              "criteria": "cpe:2.3:h:siemens:desigo_web_module_pxa40-w1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DD216D86-3876-4086-B44D-EDF1838AE286"
            },
            {
              "criteria": "cpe:2.3:h:siemens:desigo_web_module_pxa40-w2:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AFA222E8-9A0B-4F2B-9EEB-4ED666079321"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}