CVE-2016-4785: Infoleak
A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. The integrated web server (port 80/tcp) of the affected devices could allow remote attackers to obtain a limited amount of device memory content if network access was obtained. This vulnerability only affects EN100 Ethernet module included in SIPROTEC4 and SIPROTEC Compact devices.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4785?
CVE-2016-4785 is classified as a high severity vulnerability due to the potential for unauthorized access or control over affected devices.
How do I fix CVE-2016-4785?
To remediate CVE-2016-4785, update the firmware of the affected Siemens SIPROTEC devices to the latest versions as specified in the advisory.
Which devices are affected by CVE-2016-4785?
CVE-2016-4785 affects various Siemens SIPROTEC models running firmware versions below V1.04.01 for PROFINET, V1.11.00 for Modbus TCP, and V1.03 for DNP3 TCP.
What are the consequences of not addressing CVE-2016-4785?
Neglecting to address CVE-2016-4785 could lead to potential exploitation that compromises the security and functionality of the affected Siemens devices.
Is CVE-2016-4785 easily exploitable?
CVE-2016-4785 can be exploited by network-based attackers with appropriate skills, making it essential to implement security measures and firmware updates.