CVE-2016-9154

Published: Dec 23, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (All firmware versions < V6.00.046) and Desigo PX Web modules PXA30-W0, PXA30-W1, PXA30-W2 for Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U (All firmware versions < V6.00.046) use a pseudo random number generator with insufficient entropy to generate certificates for HTTPS, potentially allowing remote attackers to reconstruct the corresponding private key.

Affected (6)

Products: Siemens: Desigo Web Module Pxa30 W0 Firmware, Desigo Web Module Pxa30 W1 Firmware, Desigo Web Module Pxa30 W2 Firmware, Desigo Web Module Pxa40 W0 Firmware, Desigo Web Module Pxa40 W1 Firmware, Desigo Web Module Pxa40 W2 Firmware

Siemens

6 products

Desigo Web Module Pxa30 W0 Firmware

Desigo Web Module Pxa30 W1 Firmware

Desigo Web Module Pxa30 W2 Firmware

Desigo Web Module Pxa40 W0 Firmware

Desigo Web Module Pxa40 W1 Firmware

Desigo Web Module Pxa40 W2 Firmware

Configuration A

6 vulnerable · 6 platform

Vulnerable Software	Affected Versions
Siemens Desigo Web Module Pxa30 W0 Firmware	Up to 6.00.00
Siemens Desigo Web Module Pxa30 W1 Firmware	Up to 6.00.00
Siemens Desigo Web Module Pxa30 W2 Firmware	Up to 6.00.00
Siemens Desigo Web Module Pxa40 W0 Firmware	Up to 6.00.00
Siemens Desigo Web Module Pxa40 W1 Firmware	Up to 6.00.00
Siemens Desigo Web Module Pxa40 W2 Firmware	Up to 6.00.00

Running on/with	Platform Versions
Siemens Desigo Web Module Pxa30 W0	All versions
Siemens Desigo Web Module Pxa30 W1	All versions
Siemens Desigo Web Module Pxa30 W2	All versions
Siemens Desigo Web Module Pxa40 W0	All versions
Siemens Desigo Web Module Pxa40 W1	All versions
Siemens Desigo Web Module Pxa40 W2	All versions