CVE-2016-9154CWE-332

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware…

published December 23, 2016

CVSS
—
EPSS
1%
Percentile
73.9
In the wild
Unconfirmed
What it is

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01499 · 73.9th percentile
Weakness
CWE-332 · Insufficient Entropy in PRNG
Published
2016-12-23T05:00Z
EPSS history
Timeline
  • 23 DEC 05:00Z
    Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware…
    cvelistv5