CVE-2019-13944

Vulnerability

CVE-2019-13944 is a vulnerability in the integrated web server of Siemens EN100 Ethernet modules. It affects all variants except the IEC 61850 variant, which is only affected in versions prior to V4.37. The vulnerability allows unauthorized attackers to obtain sensitive information about the device, including logs and configurations, by exploiting improper access restrictions in the web server [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. By sending specially crafted requests to the web server, they can bypass access controls and retrieve sensitive files such as device logs and configuration data. At the time of advisory publication, no public exploitation of this vulnerability was known [1].

Impact

Successful exploitation leads to unauthorized disclosure of sensitive device information, including logs and configurations. This information could be used to gain further insights into the device's operation or to facilitate additional attacks against the device or network [1].

Mitigation

For the IEC 61850 variant, Siemens has released firmware version V4.37 to address the vulnerability. For all other affected variants, no fix is currently available. As a workaround, Siemens recommends network segmentation, restricting access to the web interface to trusted networks, and monitoring for suspicious activity. Users should consult the latest advisory from Siemens or CISA for updates [1].