CVE-2016-7113
HighSummary
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Versions below specified numbers may be susceptible to an attack that causes the device to enter defect mode upon receiving specially crafted packets on port 80/tcp.
Risk Assessment
The organization may experience device failures, leading to downtime in industrial systems and potential financial losses.
Recommendation
It is recommended to update the firmware to at least V1.04.01 for PROFINET IO, V1.11.00 for Modbus TCP, V1.03 for DNP3 TCP, V1.21 for IEC 104, and 1.02.02 for SIPROTEC Merging Unit 6MU80.
Other vulnerabilities in EN100 Ethernet module
See all- CVE-2016-7114High
A vulnerability has been identified in the EN100 Ethernet module affecting various firmware variants. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
- CVE-2015-5374High
A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that could lead to denial-of-service. Specifically crafted packets sent to port 50000/UDP could cause the device to crash.
- CVE-2016-7112Critical
A vulnerability has been identified in the EN100 Ethernet module for various firmware variants that are older than specified versions. Attackers with access to the device's web interface may bypass authentication and perform certain administrative operations.
Original NVD description (English source)
A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 80/tcp could cause the affected device to go into defect mode.