CVE-2016-9154 Details
Description
Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01 | CVE | Third Party AdvisoryUS Government Resource |
| http://www.securityfocus.com/bid/94962 | CVE | Third Party AdvisoryVDB Entry |
| http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf | CVE | MitigationVendor Advisory |
| https://ics-cert.us-cert.gov/advisories/ICSA-16-355-01 | [email protected] | Third Party AdvisoryUS Government Resource |
| http://www.securityfocus.com/bid/94962 | [email protected] | Third Party AdvisoryVDB Entry |
| http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-856492.pdf | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-332 | Insufficient Entropy in PRNG | [email protected] |
| CWE-332 | Insufficient Entropy in PRNG | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| siemens desigo web module pxa30-w0 firmware | <= 6.00.00 |
CPE
Remediation
| |
| siemens desigo web module pxa30-w1 firmware | <= 6.00.00 |
CPE
Remediation
| |
| siemens desigo web module pxa30-w2 firmware | <= 6.00.00 |
CPE
Remediation
| |
| siemens desigo web module pxa40-w0 firmware | <= 6.00.00 |
CPE
Remediation
| |
| siemens desigo web module pxa40-w1 firmware | <= 6.00.00 |
CPE
Remediation
| |
| siemens desigo web module pxa40-w2 firmware | <= 6.00.00 |
CPE
Remediation
| |
| siemens desigo web module pxa30-w0 | All versions |
CPE
Remediation
| |
| siemens desigo web module pxa30-w1 | All versions |
CPE
Remediation
| |
| siemens desigo web module pxa30-w2 | All versions |
CPE
Remediation
| |
| siemens desigo web module pxa40-w0 | All versions |
CPE
Remediation
| |
| siemens desigo web module pxa40-w1 | All versions |
CPE
Remediation
| |
| siemens desigo web module pxa40-w2 | All versions |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 6, 2026 | Status Change | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Oct 9, 2019 | CVE Modified | [email protected] |
| Dec 30, 2016 | Modified Analysis | [email protected] |
| Dec 28, 2016 | CVE Modified | [email protected] |
| Dec 24, 2016 | CVE Modified | [email protected] |
| Dec 23, 2016 | Initial Analysis | [email protected] |