CVE-2016-9154

mediumpriority · track · 31EPSS 0.015 · 74 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.50% (74th) EPSS
CVSS 5 · medium
Is it mine?
49 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-27

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • MitigationDesigo PX Web module PXA30-W0 firmware for Desigo PX automation controllers PXC00-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W0 firmware for Desigo PX automation controllers PXC128-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W0 firmware for Desigo PX automation controllers PXC64-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W1 firmware for Desigo PX automation controllers PXC00-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W1 firmware for Desigo PX automation controllers PXC128-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W1 firmware for Desigo PX automation controllers PXC64-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W2 firmware for Desigo PX automation controllers PXC00-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W2 firmware for Desigo PX automation controllers PXC128-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA30-W2 firmware for Desigo PX automation controllers PXC64-Ucisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W0 firmware for Desigo PX automation controllers PXC00-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W0 firmware for Desigo PX automation controllers PXC100-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W0 firmware for Desigo PX automation controllers PXC200-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W0 firmware for Desigo PX automation controllers PXC50-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W1 firmware for Desigo PX automation controllers PXC00-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W1 firmware for Desigo PX automation controllers PXC100-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W1 firmware for Desigo PX automation controllers PXC200-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W1 firmware for Desigo PX automation controllers PXC50-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W2 firmware for Desigo PX automation controllers PXC00-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W2 firmware for Desigo PX automation controllers PXC100-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W2 firmware for Desigo PX automation controllers PXC200-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

  • MitigationDesigo PX Web module PXA40-W2 firmware for Desigo PX automation controllers PXC50-E.Dcisa_csaf_ot

    Until patches can be applied, Siemens recommends the following: Protect network access. Apply a defense-in-depth strategies. Restrict access to Port 443/TCP of Desigo PX-Web modules. Disable the web server.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.05.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · CISA US
v3.06.9mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-332USprimaryCWE-332US
04

affected products (49)

Products and version ranges known to be affected.

showing 20 of 49
05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-16-355-01Siemens Desigo PX Web Module Insufficient Entropy Vulnerability2016-09-23icsa · cisa_csaf_otUS

    This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
published 2016-12-23modified 2026-06-17
09

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan