CVE-2016-9154 Weak cryptography in Desigo PX Web modules with all firmware versions < V6.00.046
Insufficient entropy in HTTPS certificate generation allows remote attackers to reconstruct private keys, compromising communication security in Siemens Desigo PX controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-9154?
CVE-2016-9154 is a high-severity vulnerability in Desigo PX Web modules with all firmware versions < V6.00.046, published on 23 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.
Weakness: CWE-332
Which versions are affected by CVE-2016-9154?
It affects 6 products.
Products include Siemens Desigo Web Module Pxa30-W0 Firmware, Siemens Desigo Web Module Pxa30-W1 Firmware, Siemens Desigo Web Module Pxa30-W2 Firmware, Siemens Desigo Web Module Pxa40-W0 Firmware, Siemens Desigo Web Module Pxa40-W1 Firmware, Siemens Desigo Web Module Pxa40-W2 Firmware.
How do I fix CVE-2016-9154?
No fix has been published for CVE-2016-9154 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-9154 being exploited?
There is no known exploitation of CVE-2016-9154 in the wild and no public exploit code.
Sources
Also known as GHSA-8979-mhqq-p899.