Siemens EN100 Ethernet Module DNP3 Web Interface cross site scripting

Summaryinfo

A vulnerability classified as problematic was found in Siemens EN100 Ethernet Module DNP3, EN100 Ethernet Module IEC 61850, EN100 Ethernet Module IEC104, EN100 Ethernet Module Modbus TCP and EN100 Ethernet Module PROFINET IO. This vulnerability affects unknown code of the component Web Interface. The manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2019-13943. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Siemens EN100 Ethernet Module DNP3, EN100 Ethernet Module IEC 61850, EN100 Ethernet Module IEC104, EN100 Ethernet Module Modbus TCP and EN100 Ethernet Module PROFINET IO. It has been classified as problematic. Affected is an unknown function of the component Web Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:

A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module IEC104 variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). The web interface could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify content of particular web pages, causing the application to behave in unexpected ways for legitimate users. Successful exploitation does not require for an attacker to be authenticated to the web interface. This could allow the attacker to read or modify contents of the web application. At the time of advisory publication no public exploitation of this security. vulnerability was known.

The weakness was shared 12/12/2019. This vulnerability is traded as CVE-2019-13943 since 07/18/2019. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/11/2024). The MITRE ATT&CK project declares the attack technique as T1059.007.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-147085 and VDB-147083 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Siemens

Name

• EN100 Ethernet Module DNP3
• EN100 Ethernet Module IEC104
• EN100 Ethernet Module IEC 61850
• EN100 Ethernet Module Modbus TCP
• EN100 Ethernet Module PROFINET IO

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion