CVE-2015-5374

{"id": "CVE-2015-5374", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-07-18T10:59:04.117", "references": [{"url": "http://www.securityfocus.com/bid/75948", "source": "cve@mitre.org"}, {"url": "http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-732541.pdf", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01", "source": "cve@mitre.org"}, {"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-187-03", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/44103/", "source": "cve@mitre.org"}, {"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_SSA-323211.pdf", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-19"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions < V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions < V1.03; Firmware variant IEC 104 for EN100 Ethernet module : All versions < V1.21; EN100 Ethernet module included in SIPROTEC Merging Unit 6MU80 : All versions < 1.02.02. Specially crafted packets sent to port 50000/UDP could cause a denial-of-service of the affected device. A manual reboot may be required to recover the service of the device."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en la variante de Firmware PROFINET IO para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.04.01; la variante de Firmware Modbus TCP para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.11.00; la variante de Firmware v TCP para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.03; la variante de Firmware IEC 104 para los m\u00f3dulos EN100 Ethernet: en todas las versiones anteriores a V1.21 y el m\u00f3dulo EN100 Ethernet incluido en SIPROTEC Merging Unit 6MU80: todas las versiones anteriores a la 1.02.02. Los paquetes especialmente manipulados enviados al puerto 50000/UDP podr\u00edan provocar una denegaci\u00f3n de servicio (DoS) en el dispositivo afectado. Podr\u00eda ser necesario el reinicio manual para recuperar el servicio del dispositivo."}], "lastModified": "2018-03-23T01:29:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:siprotec_firmware:4.24:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54A8F628-D8DD-48A1-BC79-802E7573CDA0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:siprotec_4:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4F0799D8-BFAC-4DC7-B465-9C757923DD94"}, {"criteria": "cpe:2.3:h:siemens:siprotec_compact:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24E3447F-6F7D-40B0-9D48-68C07FFA133B"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}