CVE-2018-4839

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

VendorProductVersions
SiemensDIGSI 4All versions < V4.92
SiemensEN100 Ethernet module DNP3 variantAll versions < V1.05.00
SiemensEN100 Ethernet module IEC 104 variantAll versions
SiemensEN100 Ethernet module IEC 61850 variantAll versions < V4.30
SiemensEN100 Ethernet module Modbus TCP variantAll versions
SiemensEN100 Ethernet module PROFINET IO variantAll versions
SiemensOther SIPROTEC 4 relaysAll versions
SiemensOther SIPROTEC Compact relaysAll versions
SiemensSIPROTEC 4 7SD80All versions < V4.70
SiemensSIPROTEC 4 7SJ61All versions < V4.96
SiemensSIPROTEC 4 7SJ62All versions < V4.96
SiemensSIPROTEC 4 7SJ64All versions < V4.96
SiemensSIPROTEC 4 7SJ66All versions < V4.30
SiemensSIPROTEC Compact 7SJ80All versions < V4.77
SiemensSIPROTEC Compact 7SK80All versions < V4.77

References

Timeline

Published
Mar 8, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-48407.5A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 ECVE-2018-48419.8A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/CVE-2018-48424.8A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNCVE-2018-48436.5A vulnerability has been identified in SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All CVE-2018-48446.7A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions CVE-2018-48458.8A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use ofCVE-2018-48469.8A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use ofCVE-2018-48474.6A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive informaCVE-2018-48486.1A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT sCVE-2018-48497.4A vulnerability has been identified in Siveillance VMS Video for Android (All versions < V12.1a (2018 R1)), Siveillance VMS Video for iOS (ACVE-2018-48507.5A vulnerability has been identified in SIMATIC S7-400 (incl. F) CPU hardware version 4.0 and below (All versions), SIMATIC S7-400 (incl. F) CVE-2018-48518.2A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the
CVE-2018-4839: Medium severity, CVSS 5.3 | Vulnix