Lucene search

SiemensCVE-2018-13807

HistorySep 12, 2018 - 2:00 p.m.

CVE-2018-13807

2018-09-1214:00:00

CWE-20

siemens

web.nvd.nist.gov

vulnerability

scalance

x300

x408

x414

denial-of-service

network security

nvd

cve-2018-13807

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

69.8%

JSON

A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versions). The web interface on port 443/tcp could allow an attacker to cause a Denial-of-Service condition by sending specially crafted packets to the web server. The device will automatically reboot, impacting network availability for other devices. An attacker must have network access to port 443/tcp to exploit the vulnerability. Neither valid credentials nor interaction by a legitimate user is required to exploit the vulnerability. There is no confidentiality or integrity impact, only availability is temporarily impacted. This vulnerability could be triggered by publicly available tools.

Affected configurations

Nvd

Node

siemensscalance_x408_firmwareRange<4.0.0

AND

siemensscalance_x408Match-

Node

siemensscalance_x300_firmwareRange<4.0.0

AND

siemensscalance_x300Match-

Node

siemensscalance_x414_firmwareMatch-

AND

siemensscalance_x414Match-

VendorProductVersionCPE
siemensscalance_x408_firmware*cpe:2.3:o:siemens:scalance_x408_firmware:*:*:*:*:*:*:*:*
siemensscalance_x408-cpe:2.3:h:siemens:scalance_x408:-:*:*:*:*:*:*:*
siemensscalance_x300_firmware*cpe:2.3:o:siemens:scalance_x300_firmware:*:*:*:*:*:*:*:*
siemensscalance_x300-cpe:2.3:h:siemens:scalance_x300:-:*:*:*:*:*:*:*
siemensscalance_x414_firmware-cpe:2.3:o:siemens:scalance_x414_firmware:-:*:*:*:*:*:*:*
siemensscalance_x414-cpe:2.3:h:siemens:scalance_x414:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	scalance_x408_firmware	*	cpe:2.3:o:siemens:scalance_x408_firmware::::::::
siemens	scalance_x408	-	cpe:2.3:h:siemens:scalance_x408:-:::::::*
siemens	scalance_x300_firmware	*	cpe:2.3:o:siemens:scalance_x300_firmware::::::::
siemens	scalance_x300	-	cpe:2.3:h:siemens:scalance_x300:-:::::::*
siemens	scalance_x414_firmware	-	cpe:2.3:o:siemens:scalance_x414_firmware:-:::::::*
siemens	scalance_x414	-	cpe:2.3:h:siemens:scalance_x414:-:::::::*

CNA Affected

[
  {
    "product": "SCALANCE X300, SCALANCE X408, SCALANCE X414",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "SCALANCE X300 : All versions < V4.0.0"
      },
      {
        "status": "affected",
        "version": "SCALANCE X408 : All versions < V4.0.0"
      },
      {
        "status": "affected",
        "version": "SCALANCE X414 : All versions"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105331

cert-portal.siemens.com/productcert/pdf/ssa-447396.pdf

ics-cert.us-cert.gov/advisories/ICSA-18-254-05

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

AI Score

8.1

Confidence

High

EPSS

0.003

Percentile

69.8%

JSON

Related for CVE-2018-13807