ID

VAR-201812-0457


CVE

CVE-2018-11462


TITLE

plural SINUMERIK Vulnerabilities related to authorization, authority, and access control in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-013317

DESCRIPTION

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). By sending a specially crafted authentication request to the affected systems a remote attacker could escalate his privileges to an elevated user account but not to root. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. SINUMERIK 808D , SINUMERIK 828D , SINUMERIK 840D sl Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Siemens SINUMERIK 808D is a CNC machine system controller from Siemens AG. Permission access control vulnerabilities exist in several Siemens products. Siemens SINUMERIK Controllers is prone to the following security vulnerabilities: 1. A heap based buffer-overflow vulnerability. 2. An integer overflow vulnerability. 3. A security bypass vulnerability. 4. An arbitrary code execution vulnerability. 5. Multiple privilege escalation vulnerabilities. 6. A stack based buffer-overflow vulnerability. 7. A buffer-overflow vulnerability. 8. Multiple denial-of-service vulnerabilities Attackers can exploit these issues to execute arbitrary code within the context of affected device, gain host privileges and perform unauthorized actions, to modify or destroy data without having proper authorization to do so, to bypass security restrictions or cause a denial-of-service condition. Siemens SINUMERIK 808D, etc

Trust: 2.79

sources: NVD: CVE-2018-11462 // JVNDB: JVNDB-2018-013317 // CNVD: CNVD-2018-25419 // BID: 106185 // IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1 // VULHUB: VHN-121324 // VULMON: CVE-2018-11462

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1 // CNVD: CNVD-2018-25419

AFFECTED PRODUCTS

vendor:siemensmodel:sinumerik 808d v4.8scope:eqversion:*

Trust: 1.0

vendor:siemensmodel:sinumerik 828d v4.7scope:lteversion:4.7

Trust: 1.0

vendor:siemensmodel:sinumerik 840d sl v4.7scope:lteversion:4.7

Trust: 1.0

vendor:siemensmodel:sinumerik 808d v4.7scope:eqversion:*

Trust: 1.0

vendor:siemensmodel:sinumerik 840d sl v4.8scope:lteversion:4.8

Trust: 1.0

vendor:siemensmodel:sinumerik 808dscope: - version: -

Trust: 0.8

vendor:siemensmodel:sinumerik 828dscope: - version: -

Trust: 0.8

vendor:siemensmodel:sinumerik 840d slscope: - version: -

Trust: 0.8

vendor:siemensmodel:sinumerik 808dscope:eqversion:v4.7

Trust: 0.6

vendor:siemensmodel:sinumerik 808dscope:eqversion:v4.8

Trust: 0.6

vendor:siemensmodel:sinumerik 840d sp6 hf5scope:ltversion:v4.7

Trust: 0.6

vendor:siemensmodel:sinumerik 840d sp3scope:ltversion:v4.8

Trust: 0.6

vendor:siemensmodel:sinumerik 828d sp6 hf1scope:ltversion:v4.7

Trust: 0.6

vendor:siemensmodel:sinumerik 808d v4.8scope: - version: -

Trust: 0.6

vendor:siemensmodel:sinumerik 808d v4.7scope: - version: -

Trust: 0.6

vendor:siemensmodel:sinumerik 828d v4.7scope:eqversion:4.7

Trust: 0.6

vendor:siemensmodel:sinumerik 840d sl v4.8scope:eqversion:4.8

Trust: 0.6

vendor:siemensmodel:sinumerik 840d sl v4.7scope:eqversion:4.7

Trust: 0.6

vendor:siemensmodel:sinumerik 840d slscope:eqversion:4.8

Trust: 0.3

vendor:siemensmodel:sinumerik 840d slscope:eqversion:4.7

Trust: 0.3

vendor:siemensmodel:sinumerik 828dscope:eqversion:4.7

Trust: 0.3

vendor:siemensmodel:sinumerik 808dscope:eqversion:4.8

Trust: 0.3

vendor:siemensmodel:sinumerik 808dscope:eqversion:4.7

Trust: 0.3

vendor:siemensmodel:sinumerik 840d sl sp3scope:neversion:4.8

Trust: 0.3

vendor:siemensmodel:sinumerik 840d sl sp6 hf5scope:neversion:4.7

Trust: 0.3

vendor:siemensmodel:sinumerik 828d sp6 hf1scope:neversion:4.7

Trust: 0.3

vendor:sinumerik 808d v4 7model: - scope:eqversion:*

Trust: 0.2

vendor:sinumerik 808d v4 8model: - scope:eqversion:*

Trust: 0.2

vendor:sinumerik 828d v4 7model: - scope:eqversion:*

Trust: 0.2

vendor:sinumerik 840d sl v4 7model: - scope:eqversion:*

Trust: 0.2

vendor:sinumerik 840d sl v4 8model: - scope:eqversion:*

Trust: 0.2

sources: IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1 // CNVD: CNVD-2018-25419 // BID: 106185 // JVNDB: JVNDB-2018-013317 // CNNVD: CNNVD-201812-603 // NVD: CVE-2018-11462

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-11462
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-11462
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-25419
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201812-603
value: CRITICAL

Trust: 0.6

IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1
value: CRITICAL

Trust: 0.2

VULHUB: VHN-121324
value: HIGH

Trust: 0.1

VULMON: CVE-2018-11462
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-11462
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-25419
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-121324
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-11462
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1 // CNVD: CNVD-2018-25419 // VULHUB: VHN-121324 // VULMON: CVE-2018-11462 // JVNDB: JVNDB-2018-013317 // CNNVD: CNNVD-201812-603 // NVD: CVE-2018-11462

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.8

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: JVNDB: JVNDB-2018-013317 // NVD: CVE-2018-11462

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201812-603

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201812-603

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013317

PATCH

title:SSA-170881url:https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Trust: 0.8

title:Patch for multiple Siemens Product Permission Access Control Vulnerabilities (CNVD-2018-25419)url:https://www.cnvd.org.cn/patchInfo/show/147325

Trust: 0.6

title:Multiple Siemens Product Privilege License and Access Control Vulnerability Fixesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87847

Trust: 0.6

title:Siemens Security Advisories: Siemens Security Advisoryurl:https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories&qid=f0c2b52e2cee7c2c16aa1cae6ed75a3b

Trust: 0.1

sources: CNVD: CNVD-2018-25419 // VULMON: CVE-2018-11462 // JVNDB: JVNDB-2018-013317 // CNNVD: CNNVD-201812-603

EXTERNAL IDS

db:NVDid:CVE-2018-11462

Trust: 3.7

db:SIEMENSid:SSA-170881

Trust: 2.7

db:BIDid:106185

Trust: 2.1

db:ICS CERTid:ICSA-18-345-02

Trust: 1.2

db:CNNVDid:CNNVD-201812-603

Trust: 0.9

db:CNVDid:CNVD-2018-25419

Trust: 0.8

db:JVNDBid:JVNDB-2018-013317

Trust: 0.8

db:IVDid:7D81E6DE-463F-11E9-A7E2-000C29342CB1

Trust: 0.2

db:VULHUBid:VHN-121324

Trust: 0.1

db:VULMONid:CVE-2018-11462

Trust: 0.1

sources: IVD: 7d81e6de-463f-11e9-a7e2-000c29342cb1 // CNVD: CNVD-2018-25419 // VULHUB: VHN-121324 // VULMON: CVE-2018-11462 // BID: 106185 // JVNDB: JVNDB-2018-013317 // CNNVD: CNNVD-201812-603 // NVD: CVE-2018-11462

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

Trust: 2.7

url:http://www.securityfocus.com/bid/106185

Trust: 1.8

url:https://ics-cert.us-cert.gov/advisories/icsa-18-345-02

Trust: 1.2

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-11462

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-11462

Trust: 0.8

url:http://subscriber.communications.siemens.com/

Trust: 0.3

url:https://www.industry.siemens.com/topics/global/en/cnc4you/cnc_downloads/sinutrain_downloads/pages/sinutrain_downloads.aspx

Trust: 0.3

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2018-25419 // VULHUB: VHN-121324 // VULMON: CVE-2018-11462 // BID: 106185 // JVNDB: JVNDB-2018-013317 // CNNVD: CNNVD-201812-603 // NVD: CVE-2018-11462

CREDITS

Anton Kalinin, Danila Parnishchev, Dmitry Sklyar, Gleb Gritsai, Kirill Nesterov, Radu Motspan, and Sergey Sidorov from Kaspersky Lab.

Trust: 0.3

sources: BID: 106185

SOURCES

db:IVDid:7d81e6de-463f-11e9-a7e2-000c29342cb1
db:CNVDid:CNVD-2018-25419
db:VULHUBid:VHN-121324
db:VULMONid:CVE-2018-11462
db:BIDid:106185
db:JVNDBid:JVNDB-2018-013317
db:CNNVDid:CNNVD-201812-603
db:NVDid:CVE-2018-11462

LAST UPDATE DATE

2024-08-14T13:45:24.280000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2018-25419date:2018-12-14T00:00:00
db:VULHUBid:VHN-121324date:2019-10-09T00:00:00
db:VULMONid:CVE-2018-11462date:2019-10-09T00:00:00
db:BIDid:106185date:2018-12-11T00:00:00
db:JVNDBid:JVNDB-2018-013317date:2019-03-14T00:00:00
db:CNNVDid:CNNVD-201812-603date:2019-10-17T00:00:00
db:NVDid:CVE-2018-11462date:2019-10-09T23:33:33.557

SOURCES RELEASE DATE

db:IVDid:7d81e6de-463f-11e9-a7e2-000c29342cb1date:2018-12-14T00:00:00
db:CNVDid:CNVD-2018-25419date:2018-12-14T00:00:00
db:VULHUBid:VHN-121324date:2018-12-12T00:00:00
db:VULMONid:CVE-2018-11462date:2018-12-12T00:00:00
db:BIDid:106185date:2018-12-11T00:00:00
db:JVNDBid:JVNDB-2018-013317date:2019-02-19T00:00:00
db:CNNVDid:CNNVD-201812-603date:2018-12-12T00:00:00
db:NVDid:CVE-2018-11462date:2018-12-12T16:29:00.497