Insufficient Script Limitation in SIMATIC WinCC OA UI Affects Android and iOS

CVE-2018-4844

Summary

A vulnerability exists in the SIMATIC WinCC OA UI for Android and iOS, where insufficient limitations on CONTROL script capabilities may lead to unauthorized read and write access between project cache folders. This risk emerges when a user unwittingly connects to a malicious WinCC OA server, allowing attackers to manipulate app data on the mobile device if they obtain user interaction. The issue affects all versions earlier than V3.15.10, but as of the advisory's release, no public exploits are recorded. Mitigations have been provided by Siemens to address this security concern.

References