Lucene search

SiemensCVE-2018-13810

HistoryApr 17, 2019 - 2:29 p.m.

CVE-2018-13810

2019-04-1714:29:03

CWE-352

siemens

web.nvd.nist.gov

cve-2018-13810

cp 1604

cp 1616

vulnerability

csrf

web server

security

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.

Affected configurations

Nvd

Node

siemenscp_1604_firmwareRange≤2.8

AND

siemenscp_1604Match-

Node

siemenscp_1616Match-

AND

siemenscp_1616_firmwareRange≤2.8

VendorProductVersionCPE
siemenscp_1604_firmware*cpe:2.3:o:siemens:cp_1604_firmware:*:*:*:*:*:*:*:*
siemenscp_1604-cpe:2.3:h:siemens:cp_1604:-:*:*:*:*:*:*:*
siemenscp_1616-cpe:2.3:h:siemens:cp_1616:-:*:*:*:*:*:*:*
siemenscp_1616_firmware*cpe:2.3:o:siemens:cp_1616_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	cp_1604_firmware	*	cpe:2.3:o:siemens:cp_1604_firmware::::::::
siemens	cp_1604	-	cpe:2.3:h:siemens:cp_1604:-:::::::*
siemens	cp_1616	-	cpe:2.3:h:siemens:cp_1616:-:::::::*
siemens	cp_1616_firmware	*	cpe:2.3:o:siemens:cp_1616_firmware::::::::

CNA Affected

[
  {
    "product": "CP 1604",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "CP 1616",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-559174.pdf

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

21.6%

JSON

Related for CVE-2018-13810