Authentication Bypass in SIMATIC IT Products by Siemens
CVE-2018-13804

8.1HIGH

Key Information:

Vendor
Siemens
Status
Simatic It Lms, Simatic It Production Suite, Simatic It Ua Discrete Manufacturing, Simatic It Ua Discrete Manufacturing, Simatic It Ua Discrete Manufacturing, Simatic It Ua Discrete Manufacturing, Simatic It Ua Discrete Manufacturing
Vendor
CVE Published:
13 December 2018

Summary

A vulnerability has been detected in various SIMATIC IT products from Siemens that enables an attacker with network access to bypass application-level authentication. This requires the attacker to have knowledge of a valid username, but does not necessitate any user privileges or interaction. Successful exploitation of this vulnerability could jeopardize the confidentiality, integrity, and availability of the affected systems, posing risks to critical processes and data security. At the time of reporting, no public exploits had been documented.

Affected Version(s)

SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing SIMATIC IT LMS : All versions

SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing SIMATIC IT Production Suite : Versions V7.1 < V7.1 Upd3 < SIMATIC IT Production Suite : Versions V7.1 V7.1 Upd3

SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing SIMATIC IT UA Discrete Manufacturing : Versions < V1.2 < SIMATIC IT UA Discrete Manufacturing : Versions V1.2

References

https://cert-portal.siemens.com/productcert/pdf/ssa-88661...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/105924
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.