Lucene search

SiemensCVE-2018-4845

HistoryJun 26, 2018 - 6:29 p.m.

CVE-2018-4845

2018-06-2618:29:00

CWE-269

CWE-284

siemens

web.nvd.nist.gov

cve-2018-4845

siemens healthineers

rapidlab

rapidpoint

vulnerability

privilege escalation

security issue

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthineers Informatics products), RAPIDLab 1200 Series (All versions < V3.3 with Siemens Healthineers Informatics products), RAPIDPoint 500 systems (All versions >= V3.0 with Siemens Healthineers Informatics products), RAPIDPoint 500 systems (V2.4.X_with_ Siemens Healthineers Informatics products), RAPIDPoint 500 systems (All versions =< V2.3 with Siemens Healthineers Informatics products), RAPIDPoint 400 systems (All versions with Siemens Healthineers Informatics products). Remote attackers with either local or remote credentialed access to the “Remote View” feature might be able to elevate their privileges, compromising confidentiality, integrity, and availability of the system. No special skills or user interaction are required to perform this attack. At the time of advisory publication, no public exploitation of this security vulnerability is known. Siemens Healthineers confirms the security vulnerability and provides mitigations to resolve the security issue.

Affected configurations

Nvd

Node

siemensrapidpoint_400_firmwareMatch-

AND

siemensrapidpoint_400Match-

Node

siemensrapidpoint_500_firmwareRange≤2.3

siemensrapidpoint_500_firmwareRange3.0≥

AND

siemensrapidpoint_500Match-

Node

siemensrapidlab_1200_firmwareRange<3.3

AND

siemensrapidlab_1200Match-

VendorProductVersionCPE
siemensrapidpoint_400_firmware-cpe:2.3:o:siemens:rapidpoint_400_firmware:-:*:*:*:*:*:*:*
siemensrapidpoint_400-cpe:2.3:h:siemens:rapidpoint_400:-:*:*:*:*:*:*:*
siemensrapidpoint_500_firmware*cpe:2.3:o:siemens:rapidpoint_500_firmware:*:*:*:*:*:*:*:*
siemensrapidpoint_500-cpe:2.3:h:siemens:rapidpoint_500:-:*:*:*:*:*:*:*
siemensrapidlab_1200_firmware*cpe:2.3:o:siemens:rapidlab_1200_firmware:*:*:*:*:*:*:*:*
siemensrapidlab_1200-cpe:2.3:h:siemens:rapidlab_1200:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	rapidpoint_400_firmware	-	cpe:2.3:o:siemens:rapidpoint_400_firmware:-:::::::*
siemens	rapidpoint_400	-	cpe:2.3:h:siemens:rapidpoint_400:-:::::::*
siemens	rapidpoint_500_firmware	*	cpe:2.3:o:siemens:rapidpoint_500_firmware::::::::
siemens	rapidpoint_500	-	cpe:2.3:h:siemens:rapidpoint_500:-:::::::*
siemens	rapidlab_1200_firmware	*	cpe:2.3:o:siemens:rapidlab_1200_firmware::::::::
siemens	rapidlab_1200	-	cpe:2.3:h:siemens:rapidlab_1200:-:::::::*

CNA Affected

[
  {
    "product": "RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems, RAPIDLab 1200 Series, RAPIDPoint 500 systems, RAPIDPoint 500 systems, RAPIDPoint 500 systems, RAPIDPoint 400 systems",
    "vendor": "Siemens AG",
    "versions": [
      {
        "status": "affected",
        "version": "RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems : All versions _without_ use of Siemens Healthineers Informatics products"
      },
      {
        "status": "affected",
        "version": "RAPIDLab 1200 Series : All versions < V3.3 _with_ Siemens Healthineers Informatics products"
      },
      {
        "status": "affected",
        "version": "RAPIDPoint 500 systems : All versions >= V3.0 _with_ Siemens Healthineers Informatics products"
      },
      {
        "status": "affected",
        "version": "RAPIDPoint 500 systems : V2.4.X _with_ Siemens Healthineers Informatics products"
      },
      {
        "status": "affected",
        "version": "RAPIDPoint 500 systems : All versions =< V2.3 _with_ Siemens Healthineers Informatics products"
      },
      {
        "status": "affected",
        "version": "RAPIDPoint 400 systems : All versions_with_ Siemens Healthineers Informatics products"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-755010.pdf

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

Related for CVE-2018-4845