VulnerabilityModified

CVE-2016-9154

HIGH 7.5EPSS 1.50%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

CVSS 3.0: 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 1.50% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-332
Affected: siemens/desigo web module pxa30-w0 firmware · siemens/desigo web module pxa30-w1 firmware · siemens/desigo web module pxa30-w2 firmware · siemens/desigo web module pxa40-w0 firmware · siemens/desigo web module pxa40-w1 firmware · siemens/desigo web module pxa40-w2 firmware
Source: productcert@siemens.com

References

http://www.securityfocus.com/bid/94962Third Party Advisory, VDB Entry
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdfMitigation, Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/94962Third Party Advisory, VDB Entry
http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdfMitigation, Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01Third Party Advisory, US Government Resource

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.