Sign-up

ID

VAR-201801-1630


CVE

CVE-2018-4837


TITLE

Siemens TeleControl Server Basic Denial of service vulnerability

Trust: 0.8

sources: IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1 // CNVD: CNVD-2018-02346

DESCRIPTION

A vulnerability has been identified in TeleControl Server Basic < V3.1. An attacker with access to the TeleControl Server Basic's webserver (port 80/tcp or 443/tcp) could cause a Denial-of-Service condition on the web server. The remaining functionality of the TeleControl Server Basic is not affected by the Denial-of-Service condition. TeleControl Server Basic Has unspecified vulnerabilities.Service operation interruption (DoS) There is a possibility of being put into a state. Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens AG. An attacker could exploit the vulnerability to cause a denial of service. An attacker can leverage these issues to obtain sensitive information, bypass security restrictions and gain elevated privileges

Trust: 2.88

sources: NVD: CVE-2018-4837 // JVNDB: JVNDB-2018-001583 // CNVD: CNVD-2018-02346 // BID: 102904 // BID: 102819 // IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1 // CNVD: CNVD-2018-02346

AFFECTED PRODUCTS

vendor:siemensmodel:telecontrol server basicscope:ltversion:3.1

Trust: 1.8

vendor:siemensmodel:telecontrol server basicsscope:ltversion:v3.1

Trust: 0.6

vendor:siemensmodel:telecontrol server basic sp2scope:eqversion:3.0

Trust: 0.6

vendor:siemensmodel:telecontrol server basicscope:eqversion:3.0

Trust: 0.6

vendor:siemensmodel:telecontrol server basicscope:neversion:3.1

Trust: 0.6

vendor:telecontrol server basicmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1 // CNVD: CNVD-2018-02346 // BID: 102904 // BID: 102819 // JVNDB: JVNDB-2018-001583 // NVD: CVE-2018-4837

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4837
value: HIGH

Trust: 1.0

NVD: CVE-2018-4837
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-02346
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201801-984
value: HIGH

Trust: 0.6

IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2018-4837
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-02346
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2018-4837
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1 // CNVD: CNVD-2018-02346 // JVNDB: JVNDB-2018-001583 // CNNVD: CNNVD-201801-984 // NVD: CVE-2018-4837

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.0

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2018-4837

THREAT TYPE

network

Trust: 0.6

sources: BID: 102904 // BID: 102819

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201801-984

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-001583

PATCH
title:SSA-651454url:https://cert-portal.siemens.com/productcert/pdf/ssa-651454.pdf
Trust: 0.8
title:Siemens TeleControl Server Basic denial of service vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/115115
Trust: 0.6
title:Siemens TeleControl Server Basic Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78097
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-02346 // 
            
            
            
            JVNDB: JVNDB-2018-001583 // 
            
            
            
            CNNVD: CNNVD-201801-984

EXTERNAL IDS
db:NVDid:CVE-2018-4837
Trust: 3.8
db:ICS CERTid:ICSA-18-030-02
Trust: 2.0
db:BIDid:102904
Trust: 1.9
db:SIEMENSid:SSA-651454
Trust: 1.9
db:BIDid:102819
Trust: 1.9
db:CNVDid:CNVD-2018-02346
Trust: 0.8
db:CNNVDid:CNNVD-201801-984
Trust: 0.8
db:JVNDBid:JVNDB-2018-001583
Trust: 0.8
db:IVDid:E2E2DC65-39AB-11E9-93D6-000C29342CB1
Trust: 0.2
sources:
            
            
            IVD: e2e2dc65-39ab-11e9-93d6-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2018-02346 // 
            
            
            
            BID: 102904 // 
            
            
            
            BID: 102819 // 
            
            
            
            JVNDB: JVNDB-2018-001583 // 
            
            
            
            CNNVD: CNNVD-201801-984 // 
            
            
            
            NVD: CVE-2018-4837

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-030-02
Trust: 2.0
url:https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-651454.pdf
Trust: 1.9
url:http://www.securityfocus.com/bid/102904
Trust: 1.6
url:http://www.securityfocus.com/bid/102819
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4837
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-4837
Trust: 0.8
url:https://support.industry.siemens.com/cs/ww/en/view/109755199
Trust: 0.6
url:http://www.siemens.com/
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-02346 // 
            
            
            
            BID: 102904 // 
            
            
            
            BID: 102819 // 
            
            
            
            JVNDB: JVNDB-2018-001583 // 
            
            
            
            CNNVD: CNNVD-201801-984 // 
            
            
            
            NVD: CVE-2018-4837

CREDITS
The vendor reported this issue.
Trust: 0.6
sources:
            
            
            BID: 102904 // 
            
            
            
            BID: 102819

SOURCES
db:IVDid:e2e2dc65-39ab-11e9-93d6-000c29342cb1
db:CNVDid:CNVD-2018-02346
db:BIDid:102904
db:BIDid:102819
db:JVNDBid:JVNDB-2018-001583
db:CNNVDid:CNNVD-201801-984
db:NVDid:CVE-2018-4837

LAST UPDATE DATE
2024-08-14T13:29:09.702000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-02346date:2018-01-31T00:00:00
db:BIDid:102904date:2018-01-30T00:00:00
db:BIDid:102819date:2018-01-25T00:00:00
db:JVNDBid:JVNDB-2018-001583date:2018-04-03T00:00:00
db:CNNVDid:CNNVD-201801-984date:2019-10-17T00:00:00
db:NVDid:CVE-2018-4837date:2019-10-09T23:41:00.563

SOURCES RELEASE DATE
db:IVDid:e2e2dc65-39ab-11e9-93d6-000c29342cb1date:2018-01-31T00:00:00
db:CNVDid:CNVD-2018-02346date:2018-01-31T00:00:00
db:BIDid:102904date:2018-01-30T00:00:00
db:BIDid:102819date:2018-01-25T00:00:00
db:JVNDBid:JVNDB-2018-001583date:2018-02-26T00:00:00
db:CNNVDid:CNNVD-201801-984date:2018-01-26T00:00:00
db:NVDid:CVE-2018-4837date:2018-01-25T14:29:00.427