Details of VAR-201807-1340

ID

VAR-201807-1340

CVE

CVE-2018-11451

TITLE

plural Siemens Vulnerability related to input validation in product firmware

Trust: 0.8

sources: JVNDB: JVNDB-2018-008870

DESCRIPTION

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethernet module (All versions), Firmware variant Modbus TCP for EN100 Ethernet module (All versions), Firmware variant DNP3 TCP for EN100 Ethernet module (All versions), Firmware variant IEC104 for EN100 Ethernet module (All versions < V1.22), SIPROTEC 5 relays with CPU variants CP300 and CP100 and the respective Ethernet communication modules (All versions < V7.80), SIPROTEC 5 relays with CPU variants CP200 and the respective Ethernet communication modules (All versions < V7.58). Specially crafted packets to port 102/tcp could cause a denial-of-service condition in the affected products. A manual restart is required to recover the EN100 module functionality of the affected devices. Successful exploitation requires an attacker with network access to send multiple packets to the affected products or modules. As a precondition the IEC 61850-MMS communication needs to be activated on the affected products or modules. No user interaction or privileges are required to exploit the vulnerability. The vulnerability could allow causing a Denial-of-Service condition of the network functionality of the device, compromising the availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. plural Siemens There is an input validation vulnerability in the product firmware.Service operation interruption (DoS) There is a possibility of being put into a state. The Siemens EN100 Ethernet Communication Module and SIPROTEC 5 relays are products of Siemens AG, Germany. The Siemens EN100 Ethernet Communication Module is an Ethernet module. SIPROTEC 5 relays are a relay. A denial of service vulnerability exists in the Siemens EN100 Ethernet Communication Module and SIPROTEC 5 relays. Attackers can exploit these issues to crash the affected application or consume excess memory, denying service to legitimate users

Trust: 2.7

sources: NVD: CVE-2018-11451 // JVNDB: JVNDB-2018-008870 // CNVD: CNVD-2018-25425 // BID: 106221 // IVD: 7d828321-463f-11e9-bc16-000c29342cb1 // VULHUB: VHN-121312

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 7d828321-463f-11e9-bc16-000c29342cb1 // CNVD: CNVD-2018-25425

AFFECTED PRODUCTS

vendor:	siemens	model:	profinet io	scope:	eq	version:	-	Trust: 1.6
vendor:	siemens	model:	modbus tcp	scope:	eq	version:	-	Trust: 1.6
vendor:	siemens	model:	cp200	scope:	eq	version:	-	Trust: 1.6
vendor:	siemens	model:	dnp3 tcp	scope:	eq	version:	-	Trust: 1.6
vendor:	siemens	model:	iec104	scope:	eq	version:	-	Trust: 1.6
vendor:	siemens	model:	cp100	scope:	lt	version:	7.80	Trust: 1.0
vendor:	siemens	model:	iec 61850	scope:	lt	version:	4.33	Trust: 1.0
vendor:	siemens	model:	cp300	scope:	lt	version:	7.80	Trust: 1.0
vendor:	siemens	model:	cp100	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	cp200	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	cp300	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	en100 ethernet module dnp3	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	en100 ethernet module iec 104	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	en100 ethernet module iec 61850	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	en100 ethernet module modbus tcp	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	en100 ethernet module profinet io	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	variant iec for en100 ethernet module	scope:	eq	version:	61850<v4.33	Trust: 0.6
vendor:	siemens	model:	variant profinet io for en100 ether- net module	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	variant modbus tcp for en100 ether- net module	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	variant dnp3 tcp for en100 ethernet module	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	variant iec104 for en100 ethernet module	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	siprotec relays with cpu variants cp300 and cp100 and the respective ethernet commu- nication modules	scope:	eq	version:	5<v7.80	Trust: 0.6
vendor:	siemens	model:	siprotec relays with cpu variants cp200 and the respective ethernet communication mod- ules	scope:	eq	version:	5<v7.58	Trust: 0.6
vendor:	siemens	model:	siprotec	scope:	eq	version:	50	Trust: 0.3
vendor:	siemens	model:	profinet io for en100	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	modbus tcp for en100	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	iec104 for en100	scope:	eq	version:	0	Trust: 0.3
vendor:	siemens	model:	iec for en100	scope:	eq	version:	618500	Trust: 0.3
vendor:	siemens	model:	siprotec cp300	scope:	ne	version:	57.80	Trust: 0.3
vendor:	siemens	model:	siprotec cp200	scope:	ne	version:	57.58	Trust: 0.3
vendor:	siemens	model:	siprotec cp100	scope:	ne	version:	57.80	Trust: 0.3
vendor:	siemens	model:	iec for en100	scope:	ne	version:	618504.33	Trust: 0.3
vendor:	dnp3 tcp	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	iec104	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	iec 61850	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	modbus tcp	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	profinet io	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	cp100	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	cp200	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	cp300	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 7d828321-463f-11e9-bc16-000c29342cb1 // CNVD: CNVD-2018-25425 // BID: 106221 // JVNDB: JVNDB-2018-008870 // CNNVD: CNNVD-201807-1730 // NVD: CVE-2018-11451

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-11451
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-11451
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-25425
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201807-1730
value:	HIGH
Trust: 0.6
IVD:	7d828321-463f-11e9-bc16-000c29342cb1
value:	HIGH
Trust: 0.2
VULHUB:	VHN-121312
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-11451
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-25425
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d828321-463f-11e9-bc16-000c29342cb1
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-121312
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-11451
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: IVD: 7d828321-463f-11e9-bc16-000c29342cb1 // CNVD: CNVD-2018-25425 // VULHUB: VHN-121312 // JVNDB: JVNDB-2018-008870 // CNNVD: CNNVD-201807-1730 // NVD: CVE-2018-11451

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-121312 // JVNDB: JVNDB-2018-008870 // NVD: CVE-2018-11451

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-1730

TYPE

Input validation

Trust: 0.8

sources: IVD: 7d828321-463f-11e9-bc16-000c29342cb1 // CNNVD: CNNVD-201807-1730

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-008870

PATCH

title:	SSA-635129	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdf	Trust: 0.8
title:	Patch for Siemens EN100 Ethernet Communication Module and SIPROTEC 5 relays denial of service vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/147343	Trust: 0.6
title:	Multiple Siemens Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82546	Trust: 0.6

sources: CNVD: CNVD-2018-25425 // JVNDB: JVNDB-2018-008870 // CNNVD: CNNVD-201807-1730

EXTERNAL IDS

db:	NVD	id:	CVE-2018-11451	Trust: 3.6
db:	SIEMENS	id:	SSA-635129	Trust: 2.6
db:	BID	id:	106221	Trust: 2.0
db:	SIEMENS	id:	SSA-325546	Trust: 1.7
db:	ICS CERT	id:	ICSA-18-347-02	Trust: 1.1
db:	ICS CERT	id:	ICSA-19-038-02	Trust: 1.1
db:	CNNVD	id:	CNNVD-201807-1730	Trust: 0.9
db:	CNVD	id:	CNVD-2018-25425	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-008870	Trust: 0.8
db:	IVD	id:	7D828321-463F-11E9-BC16-000C29342CB1	Trust: 0.2
db:	VULHUB	id:	VHN-121312	Trust: 0.1

sources: IVD: 7d828321-463f-11e9-bc16-000c29342cb1 // CNVD: CNVD-2018-25425 // VULHUB: VHN-121312 // BID: 106221 // JVNDB: JVNDB-2018-008870 // CNNVD: CNNVD-201807-1730 // NVD: CVE-2018-11451

REFERENCES

url:	https://www.securityfocus.com/bid/106221	Trust: 2.9
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-635129.pdf	Trust: 2.6
url:	https://cert-portal.siemens.com/productcert/pdf/ssa-325546.pdf	Trust: 1.7
url:	https://ics-cert.us-cert.gov/advisories/icsa-18-347-02	Trust: 1.1
url:	https://ics-cert.us-cert.gov/advisories/icsa-19-038-02	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-11451	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-11451	Trust: 0.8
url:	http://www.siemens.com/	Trust: 0.3

sources: CNVD: CNVD-2018-25425 // VULHUB: VHN-121312 // BID: 106221 // JVNDB: JVNDB-2018-008870 // CNNVD: CNNVD-201807-1730 // NVD: CVE-2018-11451

CREDITS

Victor Nikitin, and Ilya Karpov from ScadaX, Vladislav Suchkov

Trust: 0.6

sources: CNNVD: CNNVD-201807-1730

SOURCES

db:	IVD	id:	7d828321-463f-11e9-bc16-000c29342cb1
db:	CNVD	id:	CNVD-2018-25425
db:	VULHUB	id:	VHN-121312
db:	BID	id:	106221
db:	JVNDB	id:	JVNDB-2018-008870
db:	CNNVD	id:	CNNVD-201807-1730
db:	NVD	id:	CVE-2018-11451

LAST UPDATE DATE

2024-11-23T22:38:05.976000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-25425	date:	2018-12-17T00:00:00
db:	VULHUB	id:	VHN-121312	date:	2019-03-22T00:00:00
db:	BID	id:	106221	date:	2019-02-11T07:00:00
db:	JVNDB	id:	JVNDB-2018-008870	date:	2019-02-08T00:00:00
db:	CNNVD	id:	CNNVD-201807-1730	date:	2019-04-01T00:00:00
db:	NVD	id:	CVE-2018-11451	date:	2024-11-21T03:43:23.707

SOURCES RELEASE DATE

db:	IVD	id:	7d828321-463f-11e9-bc16-000c29342cb1	date:	2018-12-14T00:00:00
db:	CNVD	id:	CNVD-2018-25425	date:	2018-12-14T00:00:00
db:	VULHUB	id:	VHN-121312	date:	2018-07-23T00:00:00
db:	BID	id:	106221	date:	2018-07-11T00:00:00
db:	JVNDB	id:	JVNDB-2018-008870	date:	2018-10-31T00:00:00
db:	CNNVD	id:	CNNVD-201807-1730	date:	2018-07-23T00:00:00
db:	NVD	id:	CVE-2018-11451	date:	2018-07-23T21:29:00.237