PT-2018-16563 · Siemens · Simatic Wincc Oa Ui For Android+1

Alexander Bolshev + 1 · Publicado 2018-03-20 · Atualizado 2023-03-24 · CVE-2018-4844

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC WinCC OA UI for Android versions prior to V3.15.10 SIMATIC WinCC OA UI for iOS versions prior to V3.15.10

Description A security issue has been identified due to insufficient limitation of CONTROL script capabilities, allowing read and write access between HMI project cache folders within the app's sandbox on the same mobile device. This could be exploited by an attacker who tricks a user into connecting to a controlled server, requiring user interaction and access to the app's folder. The issue could allow data reading and writing to the app's folder. No public exploitation was known at the time of publication.

Recommendations For SIMATIC WinCC OA UI for Android versions prior to V3.15.10, update to version V3.15.10 or later. For SIMATIC WinCC OA UI for iOS versions prior to V3.15.10, update to version V3.15.10 or later.

Correção

Improper Access Control

Improper Privilege Management

Enumeração de Fraquezas

CWE-284

CWE-269

Identificadores relacionados

CVE-2018-4844

Produtos afetados

Simatic Wincc Oa Ui For Android

Simatic Wincc Oa Ui For Ios

Referências · 5

• http://securityfocus.com/bid/103475 · Nota
• https://osv.dev/vulnerability/CVE-2018-4844 · Aviso do Fabricante
• https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-081-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-4844 · Nota de Segurança