PT-2018-1570 · Siemens · Siemens Td Keypad Designer
Publicado
2018-09-11
·
Atualizado
2019-10-09
·
CVE-2018-13806
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SIEMENS TD Keypad Designer (All versions)
Description
A DLL hijacking issue exists in SIEMENS TD Keypad Designer, allowing an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access to the directory containing the TD project file to exploit this issue. A legitimate user with higher privileges than the attacker must open the TD project for this issue to be exploited. At the time of advisory publication, no public exploitation of this security issue was known. The vulnerability is related to an uncontrolled DLL search path, which can be exploited by placing a DLL in the TD project file directory.
Recommendations
For all versions, consider restricting access to the directory containing the TD project file to prevent an attacker from gaining write access, and ensure that only trusted users with the necessary privileges can open TD projects. As a temporary workaround, consider implementing additional security measures to monitor and control the execution of code with user permissions. At the moment, there is no information about a newer version that contains a fix for this issue.
Correção
Uncontrolled Search Path Element
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Siemens Td Keypad Designer