Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2018-11453
HistoryAug 07, 2018 - 3:29 p.m.

CVE-2018-11453

2018-08-0715:29:00
CWE-276
CWE-732
[email protected]
web.nvd.nist.gov
27
simatic step 7
wincc
tia portal
vulnerability
denial-of-service
local code execution
file permissions

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2 Update 2), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 6), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 (All versions < V15 Update 2). Improper file permissions in the default installation of TIA Portal may allow an attacker with local file system access to insert specially crafted files which may prevent TIA Portal startup (Denial-of-Service) or lead to local code execution. No special privileges are required, but the victim needs to attempt to start TIA Portal after the manipulation.

Affected configurations

NVD
Node
siemenssimatic_step_7_\(tia_portal\)Match10.0
OR
siemenssimatic_step_7_\(tia_portal\)Match11.0
OR
siemenssimatic_step_7_\(tia_portal\)Match12.0
OR
siemenssimatic_step_7_\(tia_portal\)Match13.0
OR
siemenssimatic_step_7_\(tia_portal\)Match13.0sp1
OR
siemenssimatic_step_7_\(tia_portal\)Match14.0
OR
siemenssimatic_step_7_\(tia_portal\)Match15.0
OR
siemenssimatic_wincc_\(tia_portal\)Match10.0
OR
siemenssimatic_wincc_\(tia_portal\)Match11.0
OR
siemenssimatic_wincc_\(tia_portal\)Match12.0
OR
siemenssimatic_wincc_\(tia_portal\)Match13.0
OR
siemenssimatic_wincc_\(tia_portal\)Match14.0
OR
siemenssimatic_wincc_\(tia_portal\)Match15.0
CPENameOperatorVersion
siemens:simatic_step_7_\(tia_portal\)siemens simatic step 7 (tia portal)eq10.0
siemens:simatic_step_7_\(tia_portal\)siemens simatic step 7 (tia portal)eq11.0
siemens:simatic_step_7_\(tia_portal\)siemens simatic step 7 (tia portal)eq12.0
siemens:simatic_step_7_\(tia_portal\)siemens simatic step 7 (tia portal)eq13.0
siemens:simatic_step_7_\(tia_portal\)siemens simatic step 7 (tia portal)eq14.0
siemens:simatic_step_7_\(tia_portal\)siemens simatic step 7 (tia portal)eq15.0
siemens:simatic_wincc_\(tia_portal\)siemens simatic wincc (tia portal)eq10.0
siemens:simatic_wincc_\(tia_portal\)siemens simatic wincc (tia portal)eq11.0
siemens:simatic_wincc_\(tia_portal\)siemens simatic wincc (tia portal)eq12.0
siemens:simatic_wincc_\(tia_portal\)siemens simatic wincc (tia portal)eq13.0
Rows per page:
1-10 of 121

CNA Affected

[
  {
    "product": "SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 : All versions"
      },
      {
        "status": "affected",
        "version": "SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 : All versions < V13 SP2 Update 2"
      },
      {
        "status": "affected",
        "version": "SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 : All versions < V14 SP1 Update 6"
      },
      {
        "status": "affected",
        "version": "SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 : All versions < V15 Update 2"
      }
    ]
  }
]

Related

prion 1
nvd 1
cvelist 1
ics 1
prion
prion
Input validation
2018-08-07 15:29:00
nvd
nvd
CVE-2018-11453
2018-08-07 15:29:00
cvelist
cvelist
CVE-2018-11453
2018-08-07 00:00:00
ics
ics
Siemens SIMATIC STEP 7 and SIMATIC WinCC (Update A)
2018-10-09 12:00:00

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON
Related for CVE-2018-11453
prion1nvd1cvelist1ics1