A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100…

Published 8 y ago 2018-03-08 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.3

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.6%

percentile 48%

Public exploits

none known

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.

Exploit prediction (EPSS)

0.58% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	5.3	`CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	3.5	`AV:N/AC:M/Au:S/C:P/I:N/A:N`

Affected products

Siemens DIGSI 4
Siemens EN100 Ethernet module DNP3 variant
Siemens EN100 Ethernet module IEC 104 variant
Siemens EN100 Ethernet module IEC 61850 variant
Siemens EN100 Ethernet module Modbus TCP variant
Siemens EN100 Ethernet module PROFINET IO variant
Siemens Other SIPROTEC 4 relays
Siemens Other SIPROTEC Compact relays
Siemens SIPROTEC 4 7SD80
Siemens SIPROTEC 4 7SJ61
Siemens SIPROTEC 4 7SJ62
Siemens SIPROTEC 4 7SJ64
Siemens SIPROTEC 4 7SJ66
Siemens SIPROTEC Compact 7SJ80
Siemens SIPROTEC Compact 7SK80

Classification

Weakness

CWE-326 Inadequate Encryption Strength

References

cert-portal.siemens.com /productcert/pdf/ssa-203306.pdf · x_refsource_CONFIRM, x_transferred
ics-cert.us-cert.gov /advisories/ICSA-18-067-01 · Third Party Advisory, US Government Resource

Sources

CVE List: CVE-2018-4839
NVD: CVE-2018-4839

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary