Authentication Bypass in SPPA-T3000 Application Server by Siemens

CVE-2019-18284

What is CVE-2019-18284?

A vulnerability exists in the SPPA-T3000 Application Server, where the AdminService can be accessed without authentication. This allows an attacker who has gained access to the Application Highway to exploit the exposed methods, potentially retrieving password hashes of other users and modifying their passwords. At the time of the security advisory, there were no known public exploits for this vulnerability.

References