Siemens SIPROTEC Information Disclosure (CVE-2016-4784)

medium Tenable OT Security Plugin ID 500308

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01;
Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02; SIPROTEC 7SJ686 : All versions < V 4.83; SIPROTEC 7UT686 : All versions < V 4.01; SIPROTEC 7SD686 : All versions < V 4.03; SIPROTEC 7SJ66 : All versions < V 4.20. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain sensitive device information if network access was obtained.

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Siemens provides firmware update V4.27 for EN100 module included in SIPROTEC 4 and SIPROTEC Compact to fix the vulnerabilities. The firmware updates can be found at the following locations on the Siemens website:

http://www.siemens.com/downloads/siprotec-4

http://www.siemens.com/downloads/siprotec-compact

For SIPROTEC Compact 7SJ80 with Ethernet Service Interface on Port A, Siemens provides firmware update V4.76. The firmware update can be found at the following location on the Siemens website:

http://www.siemens.com/downloads/siprotec-compact

An attacker must have network access to the affected devices. For remaining affected products, Siemens recommends to protect network access with appropriate mechanisms (e.g., firewalls, segmentation, VPN). It is advised to configure the environment according to Siemens operational guidelines in order to run the devices in a protected IT environment.
Siemens provides guidance at the following location for operating the devices only within trusted networks:

http://www.siemens.com/gridsecurity

For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security Advisory SSA-547990 at the following location:

http://www.siemens.com/cert/advisories

Plugin Details

Severity: Medium

ID: 500308

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 2/7/2022

Updated: 11/14/2023

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 1.4

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2016-4784

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:siemens:siprotec_4_7sj686_firmware, cpe:/o:siemens:siprotec_4_7ut686_firmware, cpe:/o:siemens:siprotec_4_7sd686_firmware, cpe:/o:siemens:siprotec_4_7sj66_firmware, cpe:/o:siemens:siprotec_compact_7sj80_firmware, cpe:/o:siemens:siprotec_compact_7rw80_firmware, cpe:/o:siemens:siprotec_compact_7sj81_firmware, cpe:/o:siemens:siprotec_compact_7sk81_firmware

Required KB Items: Tenable.ot/Siemens

Exploit Ease: No known exploits are available

Patch Publication Date: 5/31/2016

Vulnerability Publication Date: 5/31/2016

Reference Information

CVE: CVE-2016-4784

CWE: 200

Detections

Analytics