PT-2018-12195 · Siemens · Simatic S7-1200 Cpu

Publicado 2018-10-10 · Atualizado 2019-10-09 · CVE-2018-13800

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family versions prior to V4.2.3

Description A security issue has been identified that could allow a Cross-Site Request Forgery (CSRF) attack through the web interface. This attack requires user interaction by a legitimate user who must be authenticated to the web interface. If successful, an attacker could trigger actions via the web interface that the legitimate user is allowed to perform, potentially allowing the attacker to read or modify parts of the device configuration.

Recommendations For SIMATIC S7-1200 CPU family versions prior to V4.2.3, update to version V4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-13800

Produtos afetados

Simatic S7-1200 Cpu

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-13800 · Aviso do Fabricante
• http://securityfocus.com/bid/105542 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-13800 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-507847.pdf · Aviso do Fabricante