Details of VAR-201812-0461

ID

VAR-201812-0461

CVE

CVE-2018-11466

TITLE

plural SINUMERIK Access control vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-013320

DESCRIPTION

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). Specially crafted network packets sent to port 102/tcp (ISO-TSAP) could allow a remote attacker to either cause a Denial-of-Service condition of the integrated software firewall or allow to execute code in the context of the software firewall. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 102/tcp. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known. SINUMERIK 808D , SINUMERIK 828D , SINUMERIK 840D sl Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Siemens SINUMERIK 808D is a CNC machine system controller from Siemens AG. Security vulnerabilities exist in several Siemens products. And integrity. A heap based buffer-overflow vulnerability. 2. An integer overflow vulnerability. 3. A security bypass vulnerability. 4. An arbitrary code execution vulnerability. 5. Multiple privilege escalation vulnerabilities. 6. A stack based buffer-overflow vulnerability. 7. A buffer-overflow vulnerability. 8. Multiple denial-of-service vulnerabilities Attackers can exploit these issues to execute arbitrary code within the context of affected device, gain host privileges and perform unauthorized actions, to modify or destroy data without having proper authorization to do so, to bypass security restrictions or cause a denial-of-service condition. Siemens SINUMERIK 808D, etc

Trust: 2.7

sources: NVD: CVE-2018-11466 // JVNDB: JVNDB-2018-013320 // CNVD: CNVD-2018-25423 // BID: 106185 // IVD: 7d847ef2-463f-11e9-b6c1-000c29342cb1 // VULHUB: VHN-121328

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 7d847ef2-463f-11e9-b6c1-000c29342cb1 // CNVD: CNVD-2018-25423

AFFECTED PRODUCTS

vendor:	siemens	model:	sinumerik 840d sl v4.8	scope:	lte	version:	4.8	Trust: 1.0
vendor:	siemens	model:	sinumerik 808d v4.7	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	sinumerik 840d sl v4.7	scope:	lte	version:	4.7	Trust: 1.0
vendor:	siemens	model:	sinumerik 808d v4.8	scope:	eq	version:	*	Trust: 1.0
vendor:	siemens	model:	sinumerik 828d v4.7	scope:	lte	version:	4.7	Trust: 1.0
vendor:	siemens	model:	sinumerik 808d	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	sinumerik 828d	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	sinumerik 840d sl	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	sinumerik 808d	scope:	eq	version:	v4.7	Trust: 0.6
vendor:	siemens	model:	sinumerik 808d	scope:	eq	version:	v4.8	Trust: 0.6
vendor:	siemens	model:	sinumerik 840d sp6 hf5	scope:	lt	version:	v4.7	Trust: 0.6
vendor:	siemens	model:	sinumerik 840d sp3	scope:	lt	version:	v4.8	Trust: 0.6
vendor:	siemens	model:	sinumerik 828d sp6 hf1	scope:	lt	version:	v4.7	Trust: 0.6
vendor:	siemens	model:	sinumerik 808d v4.8	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	sinumerik 808d v4.7	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	sinumerik 828d v4.7	scope:	eq	version:	4.7	Trust: 0.6
vendor:	siemens	model:	sinumerik 840d sl v4.8	scope:	eq	version:	4.8	Trust: 0.6
vendor:	siemens	model:	sinumerik 840d sl v4.7	scope:	eq	version:	4.7	Trust: 0.6
vendor:	siemens	model:	sinumerik 840d sl	scope:	eq	version:	4.8	Trust: 0.3
vendor:	siemens	model:	sinumerik 840d sl	scope:	eq	version:	4.7	Trust: 0.3
vendor:	siemens	model:	sinumerik 828d	scope:	eq	version:	4.7	Trust: 0.3
vendor:	siemens	model:	sinumerik 808d	scope:	eq	version:	4.8	Trust: 0.3
vendor:	siemens	model:	sinumerik 808d	scope:	eq	version:	4.7	Trust: 0.3
vendor:	siemens	model:	sinumerik 840d sl sp3	scope:	ne	version:	4.8	Trust: 0.3
vendor:	siemens	model:	sinumerik 840d sl sp6 hf5	scope:	ne	version:	4.7	Trust: 0.3
vendor:	siemens	model:	sinumerik 828d sp6 hf1	scope:	ne	version:	4.7	Trust: 0.3
vendor:	sinumerik 808d v4 7	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	sinumerik 808d v4 8	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	sinumerik 840d sl v4 7	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	sinumerik 840d sl v4 8	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	sinumerik 828d v4 7	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 7d847ef2-463f-11e9-b6c1-000c29342cb1 // CNVD: CNVD-2018-25423 // BID: 106185 // JVNDB: JVNDB-2018-013320 // CNNVD: CNNVD-201812-607 // NVD: CVE-2018-11466

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-11466
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-11466
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2018-25423
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201812-607
value:	CRITICAL
Trust: 0.6
IVD:	7d847ef2-463f-11e9-b6c1-000c29342cb1
value:	CRITICAL
Trust: 0.2
VULHUB:	VHN-121328
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-11466
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-25423
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d847ef2-463f-11e9-b6c1-000c29342cb1
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-121328
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-11466
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: 7d847ef2-463f-11e9-b6c1-000c29342cb1 // CNVD: CNVD-2018-25423 // VULHUB: VHN-121328 // JVNDB: JVNDB-2018-013320 // CNNVD: CNNVD-201812-607 // NVD: CVE-2018-11466

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-248	Trust: 1.0
problemtype:	CWE-284	Trust: 0.8

sources: JVNDB: JVNDB-2018-013320 // NVD: CVE-2018-11466

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201812-607

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201812-607

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013320

PATCH

title:	SSA-170881	url:	https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf	Trust: 0.8
title:	Patches for multiple Siemens product remote code execution vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/147347	Trust: 0.6
title:	Multiple Siemens Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87852	Trust: 0.6

sources: CNVD: CNVD-2018-25423 // JVNDB: JVNDB-2018-013320 // CNNVD: CNNVD-201812-607

EXTERNAL IDS

db:	NVD	id:	CVE-2018-11466	Trust: 3.6
db:	SIEMENS	id:	SSA-170881	Trust: 2.6
db:	BID	id:	106185	Trust: 2.0
db:	ICS CERT	id:	ICSA-18-345-02	Trust: 1.1
db:	CNNVD	id:	CNNVD-201812-607	Trust: 0.9
db:	CNVD	id:	CNVD-2018-25423	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-013320	Trust: 0.8
db:	IVD	id:	7D847EF2-463F-11E9-B6C1-000C29342CB1	Trust: 0.2
db:	VULHUB	id:	VHN-121328	Trust: 0.1

sources: IVD: 7d847ef2-463f-11e9-b6c1-000c29342cb1 // CNVD: CNVD-2018-25423 // VULHUB: VHN-121328 // BID: 106185 // JVNDB: JVNDB-2018-013320 // CNNVD: CNNVD-201812-607 // NVD: CVE-2018-11466

REFERENCES

url:	https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf	Trust: 2.6
url:	http://www.securityfocus.com/bid/106185	Trust: 1.7
url:	https://ics-cert.us-cert.gov/advisories/icsa-18-345-02	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-11466	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-11466	Trust: 0.8
url:	http://subscriber.communications.siemens.com/	Trust: 0.3
url:	https://www.industry.siemens.com/topics/global/en/cnc4you/cnc_downloads/sinutrain_downloads/pages/sinutrain_downloads.aspx	Trust: 0.3

sources: CNVD: CNVD-2018-25423 // VULHUB: VHN-121328 // BID: 106185 // JVNDB: JVNDB-2018-013320 // CNNVD: CNNVD-201812-607 // NVD: CVE-2018-11466

CREDITS

Anton Kalinin, Danila Parnishchev, Dmitry Sklyar, Gleb Gritsai, Kirill Nesterov, Radu Motspan, and Sergey Sidorov from Kaspersky Lab.

Trust: 0.3

sources: BID: 106185

SOURCES

db:	IVD	id:	7d847ef2-463f-11e9-b6c1-000c29342cb1
db:	CNVD	id:	CNVD-2018-25423
db:	VULHUB	id:	VHN-121328
db:	BID	id:	106185
db:	JVNDB	id:	JVNDB-2018-013320
db:	CNNVD	id:	CNNVD-201812-607
db:	NVD	id:	CVE-2018-11466

LAST UPDATE DATE

2024-11-23T21:37:55.777000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-25423	date:	2019-01-15T00:00:00
db:	VULHUB	id:	VHN-121328	date:	2019-10-09T00:00:00
db:	BID	id:	106185	date:	2018-12-11T00:00:00
db:	JVNDB	id:	JVNDB-2018-013320	date:	2019-03-14T00:00:00
db:	CNNVD	id:	CNNVD-201812-607	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-11466	date:	2024-11-21T03:43:25.563

SOURCES RELEASE DATE

db:	IVD	id:	7d847ef2-463f-11e9-b6c1-000c29342cb1	date:	2018-12-14T00:00:00
db:	CNVD	id:	CNVD-2018-25423	date:	2018-12-14T00:00:00
db:	VULHUB	id:	VHN-121328	date:	2018-12-12T00:00:00
db:	BID	id:	106185	date:	2018-12-11T00:00:00
db:	JVNDB	id:	JVNDB-2018-013320	date:	2019-02-19T00:00:00
db:	CNNVD	id:	CNNVD-201812-607	date:	2018-12-12T00:00:00
db:	NVD	id:	CVE-2018-11466	date:	2018-12-12T16:29:00.700