Siemens AG SIMATIC WinCC OA V3.14 and prior
En bref
- Source
- NVD
- EPSS
- EPSS 2.25 % · centile 83 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- siemens
- Statut NVD
- Modified
Description
A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected product could allow an unauthenticated remote user to escalate its privileges in the context of SIMATIC WinCC OA V3.14. This vulnerability could be exploited by an attacker with network access to port 5678/TCP of the SIMATIC WinCC OA V3.14 server. Successful exploitation requires no user privileges and no user interaction. This vulnerability could allow an attacker to compromise integrity and availability of the SIMATIC WinCC OA system. At the time of advisory publication no public exploitation of this vulnerability was known.
Faiblesses (CWE)
- CWE-269 — Gestion incorrecte des privilèges
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-5735
- GCVE · GCVE-0-2018-13799
Avis du CERT-FR
- CERTFR-2018-AVI-429 — Multiples vulnérabilités dans SCADA les produits Siemens · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:siemens:simatic_wincc_open_architecture:*:*:*:*:*:*:*:*≤ 3.14
Produits affectés
| Produit | Versions |
|---|---|
| Siemens AG · SIMATIC WinCC OA V3.14 and prior | affected SIMATIC WinCC OA V3.14 and prior : All versions < V3.14-P021 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |