Remote Code Execution Vulnerability in Siemens Networking Products
CVE-2018-4833

8.8HIGH

Key Information:

Vendor
Siemens
Status
Rfid 181eip
Ruggedcom Win
Scalance X-200 Switch Family (incl. Siplus Net Variants)
Scalance X-200irt Switch Family (incl. Siplus Net Variants)
Vendor
CVE Published:
14 June 2018

Summary

A vulnerability exists in various Siemens networking products that could allow unprivileged remote attackers within the same local network segment to execute arbitrary code. This is achieved by sending a specially crafted DHCP response to a client's request. The affected products include multiple models of the RUGGEDCOM and SCALANCE series, with specific version limitations. Addressing this vulnerability is essential to mitigate potential exploits.

Affected Version(s)

RFID 181EIP All versions

RUGGEDCOM Win V4.4, V4.5, V5.0, and V5.1

SCALANCE X-200 switch family (incl. SIPLUS NET variants) All versions < V5.2.3

References

https://cert-portal.siemens.com/productcert/pdf/ssa-18101...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.