CVE-2018-4839

lowpriority · track · 21EPSS 0.006 · 47 %ileDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.58% (47th) EPSS

CVSS 3.5 · low

Is it mine?

84 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

A vulnerability has been identified in DIGSI 4 (All versions < V4.92), EN100 Ethernet module DNP3 variant (All versions < V1.05.00), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.30), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions), Other SIPROTEC 4 relays (All versions), Other SIPROTEC Compact relays (All versions), SIPROTEC 4 7SD80 (All versions < V4.70), SIPROTEC 4 7SJ61 (All versions < V4.96), SIPROTEC 4 7SJ62 (All versions < V4.96), SIPROTEC 4 7SJ64 (All versions < V4.96), SIPROTEC 4 7SJ66 (All versions < V4.30), SIPROTEC Compact 7SJ80 (All versions < V4.77), SIPROTEC Compact 7SK80 (All versions < V4.77). An attacker with local access to the engineering system or in a privileged network position and able to obtain certain network traffic could possibly reconstruct access authorization passwords.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedDIGSI 4siemens_psirt
Update to V4.92
https://support.industry.siemens.com/cs/ww/en/view/109740980
FixedEN100 Ethernet module DNP3 variantsiemens_psirt
Update to V1.05.00 and configure DIGSI 4 connection password
https://support.industry.siemens.com/cs/us/en/view/109745821
FixedEN100 Ethernet module IEC 61850 variantsiemens_psirt
Update to V4.30 and configure DIGSI 4 connection password
https://support.industry.siemens.com/cs/us/en/view/109745821
FixedSIPROTEC 4 7SD80siemens_psirt
Update to V4.70
https://support.industry.siemens.com/cs/us/en/view/109742758
FixedSIPROTEC 4 7SJ61siemens_psirt
Update to V4.96
https://support.industry.siemens.com/cs/us/en/view/109743551
FixedSIPROTEC 4 7SJ62siemens_psirt
Update to V4.96
https://support.industry.siemens.com/cs/us/en/view/109743551
FixedSIPROTEC 4 7SJ64siemens_psirt
Update to V4.96
https://support.industry.siemens.com/cs/us/en/view/109743551
FixedSIPROTEC 4 7SJ66siemens_psirt
Update to V4.30
https://support.industry.siemens.com/cs/us/en/view/109743555
FixedSIPROTEC Compact 7SJ80siemens_psirt
Update to V4.77
https://support.industry.siemens.com/cs/us/en/view/109742699
FixedSIPROTEC Compact 7SK80siemens_psirt
Update to V4.77
https://support.industry.siemens.com/cs/us/en/view/109742712
FixedDIGSI 4cisa_csaf_ot
Update to V4.92
https://support.industry.siemens.com/cs/ww/en/view/109740980
FixedEN100 Ethernet module DNP3 variantcisa_csaf_ot
Update to V1.05.00 and configure DIGSI 4 connection password
https://support.industry.siemens.com/cs/us/en/view/109745821
FixedEN100 Ethernet module IEC 61850 variantcisa_csaf_ot
Update to V4.30 and configure DIGSI 4 connection password
https://support.industry.siemens.com/cs/us/en/view/109745821
FixedSIPROTEC 4 7SD80cisa_csaf_ot
Update to V4.70
https://support.industry.siemens.com/cs/us/en/view/109742758
FixedSIPROTEC 4 7SJ61cisa_csaf_ot
Update to V4.96
https://support.industry.siemens.com/cs/us/en/view/109743551
FixedSIPROTEC 4 7SJ62cisa_csaf_ot
Update to V4.96
https://support.industry.siemens.com/cs/us/en/view/109743551
FixedSIPROTEC 4 7SJ64cisa_csaf_ot
Update to V4.96
https://support.industry.siemens.com/cs/us/en/view/109743551
FixedSIPROTEC 4 7SJ66cisa_csaf_ot
Update to V4.30
https://support.industry.siemens.com/cs/us/en/view/109743555
FixedSIPROTEC Compact 7SJ80cisa_csaf_ot
Update to V4.77
https://support.industry.siemens.com/cs/us/en/view/109742699
FixedSIPROTEC Compact 7SK80cisa_csaf_ot
Update to V4.77
https://support.industry.siemens.com/cs/us/en/view/109742712
MitigationDIGSI 4siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module DNP3 variantsiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module IEC 104 variantsiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module IEC 61850 variantsiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module Modbus TCP variantsiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module PROFINET IO variantsiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationOther SIPROTEC 4 relayssiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationOther SIPROTEC Compact relayssiemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SD80siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ61siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ62siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ64siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ66siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC Compact 7SJ80siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC Compact 7SK80siemens_psirt
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationDIGSI 4cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module DNP3 variantcisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module IEC 104 variantcisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module IEC 61850 variantcisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module Modbus TCP variantcisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationEN100 Ethernet module PROFINET IO variantcisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationOther SIPROTEC 4 relayscisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationOther SIPROTEC Compact relayscisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SD80cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ61cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ62cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ64cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC 4 7SJ66cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC Compact 7SJ80cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
MitigationSIPROTEC Compact 7SK80cisa_csaf_ot
Apply secure substation concept and Defense-in-Depth (see https://www.siemens.com/gridsecurity) or contact customer care to find specific solutions.
No fix availableEN100 Ethernet module IEC 104 variantsiemens_psirt
Currently no remediation is available
No fix availableEN100 Ethernet module Modbus TCP variantsiemens_psirt
Currently no remediation is available
No fix availableEN100 Ethernet module PROFINET IO variantsiemens_psirt
Currently no remediation is available
No fix availableOther SIPROTEC 4 relayssiemens_psirt
Currently no remediation is available
No fix availableOther SIPROTEC Compact relayssiemens_psirt
Currently no remediation is available
No fix availableEN100 Ethernet module IEC 104 variantcisa_csaf_ot
Currently no remediation is available
No fix availableEN100 Ethernet module Modbus TCP variantcisa_csaf_ot
Currently no remediation is available
No fix availableEN100 Ethernet module PROFINET IO variantcisa_csaf_ot
Currently no remediation is available
No fix availableOther SIPROTEC 4 relayscisa_csaf_ot
Currently no remediation is available
No fix availableOther SIPROTEC Compact relayscisa_csaf_ot
Currently no remediation is available

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–5.3

v2.03.5lowAV:N/AC:M/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 6.8 · impact 2.9

v3.05.3mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 1.6 · impact 3.6

v3.04.9mediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.15.3mediumAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.14mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-285USCWE-326USCWE-326USCWE-326US

affected products (84)

Products and version ranges known to be affected.

DIGSI 4all versionscisa_csaf_otUS
EN100 Ethernet module DNP3 variantall versionscisa_csaf_otUS
EN100 Ethernet module IEC 104 variantall versionscisa_csaf_otUS
EN100 Ethernet module IEC 61850 variantall versionscisa_csaf_otUS
EN100 Ethernet module Modbus TCP variantall versionscisa_csaf_otUS
EN100 Ethernet module PROFINET IO variantall versionscisa_csaf_otUS
Other SIPROTEC 4 relaysall versionscisa_csaf_otUS
Other SIPROTEC Compact relaysall versionscisa_csaf_otUS
SIPROTEC 4 7SD80all versionscisa_csaf_otUS
SIPROTEC 4 7SJ61all versionscisa_csaf_otUS
SIPROTEC 4 7SJ62all versionscisa_csaf_otUS
SIPROTEC 4 7SJ64all versionscisa_csaf_otUS
SIPROTEC 4 7SJ66all versionscisa_csaf_otUS
SIPROTEC Compact 7SJ80all versionscisa_csaf_otUS
SIPROTEC Compact 7SK80all versionscisa_csaf_otUS
Siemens DIGSI 4< V4.92cisa_csaf_otUS
Siemens EN100 Ethernet module DNP3 variant< V1.05.00cisa_csaf_otUS
Siemens EN100 Ethernet module IEC 104 variant≤ vers:all/*cisa_csaf_otUS
Siemens EN100 Ethernet module IEC 61850 variant< V4.30cisa_csaf_otUS
Siemens EN100 Ethernet module Modbus TCP variant≤ vers:all/*cisa_csaf_otUS

showing 20 of 84

advisories (2)

Vendor and ecosystem advisories describing this.

SSA-203306SSA-203306: Password Vulnerabilities in SIPROTEC 4 and SIPROTEC Compact Relay Families2018-03-08csaf · siemens_psirtDE
SIPROTEC 4 and SIPROTEC Compact devices could allow access authorization passwords to be reconstructed or overwritten via engineering mechanisms that involve DIGSI 4 and EN100 Ethernet communication modules. Siemens has released updates for several affected products, and recommends specific countermeasures for the remaining products.
ICSA-18-067-01Siemens SIPROTEC 4, SIPROTEC Compact, DIGSI 4, and EN100 Ethernet Module (Update D)2018-03-08icsa · cisa_csaf_otUS
SIPROTEC 4 and SIPROTEC Compact devices could allow access authorization passwords to be reconstructed or overwritten via engineering mechanisms that involve DIGSI 4 and EN100 Ethernet communication modules. Siemens has released updates for several affected products, and recommends specific countermeasures for the remaining products.

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot siemens_psirt NVD CVE.org MITRE

published 2018-03-08modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf cnnvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01 cnnvd
https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdf enisa_euvd
https://cert-portal.siemens.com/productcert/pdf/ssa-203306.pdfPatchVendor Advisorynvd
https://ics-cert.us-cert.gov/advisories/ICSA-18-067-01Third Party AdvisoryUS Government Resourcenvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan