PT-2018-16576 · Siemens · Scalance M875

Publicado 2018-06-26 · Atualizado 2019-10-09 · CVE-2018-4859

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SCALANCE M875 (All versions)

Description A security issue has been identified that allows an authenticated remote attacker with access to the web interface (443/tcp) to execute arbitrary operating system commands. The attacker must have network access to the web interface and be authenticated as an administrative user. This could allow the attacker to execute arbitrary code on the device. There are no known public exploits of this issue at the time of publication.

Recommendations For SCALANCE M875, restrict access to the web interface to minimize the risk of exploitation. As a temporary workaround, consider limiting administrative user access until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-4859

Produtos afetados

Scalance M875

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2018-4859 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdf · Nota