Lucene search

[email protected]CVE-2018-13814

HistoryDec 13, 2018 - 4:29 p.m.

CVE-2018-13814

2018-12-1316:29:00

CWE-20

CWE-113

[email protected]

web.nvd.nist.gov

cve-2018-13814

simatic

hmi

comfort panels

wincc

http

header injection

security vulnerability

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

53.7%

JSON

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

Affected configurations

NVD

Node

siemenssimatic_hmi_comfort_panels_firmwareRange<14.0

AND

siemenssimatic_hmi_comfort_panelsMatch-

Node

siemenssimatic_hmi_comfort_outdoor_panels_firmwareRange<14.0

AND

siemenssimatic_hmi_comfort_outdoor_panelsMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp400f_firmwareRange<14.0

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp400fMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp700_firmwareRange<14.0

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp700Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp700f_firmwareRange<14.0

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp700fMatch-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp900_firmwareRange<14.0

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp900Match-

Node

siemenssimatic_hmi_ktp_mobile_panels_ktp900f_firmwareRange<14.0

AND

siemenssimatic_hmi_ktp_mobile_panels_ktp900fMatch-

Node

siemenssimatic_wincc_\(tia_portal\)Range<14.0

siemenssimatic_wincc_runtimeRange<14.0advanced

siemenssimatic_wincc_runtimeRange<14.0professional

Node

siemenssimatic_hmi_tp_firmware

AND

siemenssimatic_hmi_tpMatch-

Node

siemenssimatic_hmi_mp_firmware

AND

siemenssimatic_hmi_mpMatch-

Node

siemenssimatic_hmi_op_firmware

AND

siemenssimatic_hmi_opMatch-

CPENameOperatorVersion
siemens:simatic_hmi_comfort_panels_firmwaresiemens simatic hmi comfort panels firmwarelt14.0

CPE	Name	Operator	Version
siemens:simatic_hmi_comfort_panels_firmware	siemens simatic hmi comfort panels firmware	lt	14.0

CNA Affected

[
  {
    "product": "SIMATIC HMI Comfort Panels 4\" - 22\", SIMATIC HMI Comfort Outdoor Panels 7\" & 15\", SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F, SIMATIC WinCC Runtime Advanced, SIMATIC WinCC Runtime Professional, SIMATIC WinCC (TIA Portal), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "SIMATIC HMI Comfort Panels 4\" - 22\" : All versions < V14"
      },
      {
        "status": "affected",
        "version": "SIMATIC HMI Comfort Outdoor Panels 7\" & 15\" : All versions < V14"
      },
      {
        "status": "affected",
        "version": "SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F : All versions < V14"
      },
      {
        "status": "affected",
        "version": "SIMATIC WinCC Runtime Advanced : All versions < V14"
      },
      {
        "status": "affected",
        "version": "SIMATIC WinCC Runtime Professional : All versions < V14"
      },
      {
        "status": "affected",
        "version": "SIMATIC WinCC (TIA Portal) : All versions < V14"
      },
      {
        "status": "affected",
        "version": "SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) : All versions"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105931

cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

53.7%

JSON

Related for CVE-2018-13814

ics1 cvelist1 nvd1 prion1 threatpost1