CVE:CVE-2018-4840
CNNVD:CNNVD-201803-228
SIEMENS DIGSI 4是美国SIEMENS公司的一个驱动程序。提供设备驱动程序功能。Siemens EN100 Ethernet module是德国Siemens公司的一个以太网模块。
多款Siemens产品中存在访问控制错误漏洞，该漏洞源于程序没有对重要的功能执行身份验证。远程攻击者可利用该漏洞上传已更改的设备配置，覆盖访问授权密码。以下产品和版本受到影响：Siemens DIGSI 4 4.92之前版本，EN100 Ethernet module IEC 61850 variant 4.30之前的版本；EN100 Ethernet module PROFINET IO variant；EN100 Ethernet module Modbus TCP variant；EN100 Ethernet module DNP3 variant；EN100 Ethernet module IEC 104 variant。
solution:Upgrade siemens siprotec_compact_7sj80_firmware to a higher version than 4.77,and avoid the version (,4.77); Upgrade siemens siprotec_compact_7sk80_firmware to a higher version than 4.77,and avoid the version (,4.77); Upgrade siemens siprotec_4_7sj66_firmware to a higher version than 4.30,and avoid the version (,4.30); Upgrade siemens digsi_4 to a higher version than 4.92,and avoid the version (,4.92); Upgrade siemens en100_ethernet_module_iec_104_firmware to a higher version than -; Upgrade siemens en100_ethernet_module_dnp3_firmware to a higher version than -; Upgrade siemens en100_ethernet_module_modbus_tcp_firmware to a higher version than -; Upgrade siemens en100_ethernet_module_profinet_io_firmware to a higher version than -; Upgrade siemens en100_ethernet_module_iec_61850_firmware to a higher version than 4.30,and avoid the version (,4.30)