CVEvulnerability

CVE-2016-9154

7.5 HIGH Published 2016-12-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-12-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-332

Description

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

Affected configurations

• siemens desigo web module pxa30-w0 firmware (<= 6.00.00) • siemens desigo web module pxa30-w1 firmware (<= 6.00.00) • siemens desigo web module pxa30-w2 firmware (<= 6.00.00) • siemens desigo web module pxa40-w0 firmware (<= 6.00.00) • siemens desigo web module pxa40-w1 firmware (<= 6.00.00) • siemens desigo web module pxa40-w2 firmware (<= 6.00.00)

Related

Weakness · CWE (1)

  • CWE-332 Insufficient Entropy in PRNG weakness

References