Path traversal in Siemens EN100 Ethernet module DNP3 variant
Priority LOW 27CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.
Summary
A vulnerability has been identified in EN100 Ethernet module DNP3 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module IEC104 variant (All versions), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). A vulnerability in the integrated web server of the affected devices could allow unauthorized attackers to obtain sensitive information about the device, including logs and configurations. At the time of advisory publication no public exploitation of this security vulnerability was known.
Why it matters now
EPSS 0.016 75th percentileScored 2026-11-07
Fix Fixed EN100 Ethernet module IEC 61850 variant (Siemens AG): V4.37
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | EN100 Ethernet module DNP3 variant | All versions | — | No fix listed | CNA |
| Siemens | EN100 Ethernet module IEC 61850 variant | before V4.37 | V4.37 | Patch available | CNA |
| Siemens | EN100 Ethernet module IEC104 variant | All versions | — | No fix listed | CNA |
| Siemens | EN100 Ethernet module Modbus TCP variant | All versions | — | No fix listed | CNA |
| Siemens | EN100 Ethernet module PROFINET IO variant | All versions | — | No fix listed | CNA |
- EN100 Ethernet module DNP3 variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
- EN100 Ethernet module IEC 61850 variant VendorSiemens Affected before V4.37 Fixed in V4.37 Patch available CNA
- EN100 Ethernet module IEC104 variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
- EN100 Ethernet module Modbus TCP variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
- EN100 Ethernet module PROFINET IO variant VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_dnp3_tcp:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec_61850:*:*:*:*:*:*:*:* | before 4.37 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec104:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_modbus_tcp:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_profinet_io:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_dnp3_tcp:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec_61850:*:*:*:*:*:*:*:* Versions before 4.37 Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_iec104:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_modbus_tcp:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:o:siemens:en100_ethernet_module_with_firmware_variant_profinet_io:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA EN100 Ethernet module IEC 61850 variant (Siemens AG) Fixed in V4.37
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13944
- 2026-10-03 Alias added: GHSA-hm36-8847-6hhf
References
More Siemens En100 Ethernet Module With Firmware Variant Dnp3 Tcp vulnerabilities
- TI-2019-10395 Memory corruption in Siemens EN100 Ethernet module DNP3 variant CVSS 3.1HIGH 7.5
- TI-2019-10396 Cross-site scripting in Siemens EN100 Ethernet module DNP3 variant CVSS 3.1MEDIUM 6.1
- TI-2018-11881 A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet… CVSS 3.0MEDIUM 5.9
Sources
- CVE-2019-13944 · CVE Program
- CVE-2019-13944 · NVD
- FIRST EPSS
- GHSA-hm36-8847-6hhf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences