CVE-2019-13944

MEDIUM

Siemens EN100 Ethernet Module - Unauthenticated Path Traversal via Web Server

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module IEC104 variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). A vulnerability in the integrated web server of the affected devices could allow unauthorized attackers to obtain sensitive information about the device, including logs and configurations. At the time of advisory publication no public exploitation of this security vulnerability was known.

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-19-344-07

Scores

CVSS v3 5.3
EPSS 0.0026
EPSS Percentile 49.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-22 CWE-23
Status published
Products (5)
siemens/en100_ethernet_module_with_firmware_variant_dnp3_tcp
siemens/en100_ethernet_module_with_firmware_variant_iec104
siemens/en100_ethernet_module_with_firmware_variant_iec_61850 < 4.37
siemens/en100_ethernet_module_with_firmware_variant_modbus_tcp
siemens/en100_ethernet_module_with_firmware_variant_profinet_io
Published Dec 12, 2019
Tracked Since Feb 18, 2026