ICSA-19-043-06 Siemens CP1604 and CP1616 (Update A)

🗓️ 08 Jan 2019 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 72 Views

Siemens CP1604 and CP1616 (Update A) advisory for vulnerabilities including cleartext transmission, XSS, and CSRF with recommended mitigations

Reporter	Title	Published	Views	Family All 34
Tenable Nessus	Siemens CP 1604 and 1616 <= v2.8 Cleartext Transmission of Sensitive Information	5 Jun 201900:00	–	nessus
Tenable Nessus	Siemens CP 1604 and 1616 <= v2.8 Improper Neutralization of Input during Web Page Generation	5 Jun 201900:00	–	nessus
Tenable Nessus	Siemens CP 1604 and 1616 <= v2.8 Cross-Site Request Forgery	5 Jun 201900:00	–	nessus
Tenable Nessus	Siemens CP1604 and CP1616 Cleartext Transmission of Sensitive Information (CVE-2018-13808)	20 Feb 202400:00	–	nessus
Tenable Nessus	Siemens CP1604 and CP1616 Improper Neutralization of Input During Web Page Generation (CVE-2018-13809)	20 Feb 202400:00	–	nessus
Tenable Nessus	Siemens CP1604 and CP1616 Cross-Site Request Forgery (CVE-2018-13810)	20 Feb 202400:00	–	nessus
BDU FSTEC	The vulnerability of Siemens CP’s communication module’s microprogramming software lies in the lack of authentication for the Telnet service. This allows attackers to obtain internal information or cause service failures.	30 Aug 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Siemens CP’s communication module’s microprogramming software, related to the lack of protective measures for website structures, allows attackers to carry out cross-site scripting attacks.	30 Aug 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Siemens CP’s communication module’s microprogramming software, related to cross-site request forgery, allows attackers to carry out attacks.	30 Aug 201900:00	–	bdu_fstec
Circl	CVE-2018-13808	17 Apr 201918:33	–	circl

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-559174.txt
raw	www.raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2019/icsa-19-043-06.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-19-043-06
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

08 Jan 2019 00:00Current

8.3High risk

Vulners AI Score8.3

CVSS 26.4

CVSS 39.1

EPSS0.00566