PT-2018-2979 · Siemens · Siemens Cp 1616+1

Publicado 2018-01-08 · Atualizado 2019-07-11 · CVE-2018-13810

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Siemens CP 1604 versions all Siemens CP 1616 versions all

Description The issue is related to a Cross-Site Request Forgery (CSRF) attack. It may allow a remote attacker to perform actions via the web interface that a legitimate user is allowed to, if the user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user.

Recommendations For Siemens CP 1604, restrict access to the integrated configuration web server to minimize the risk of exploitation. For Siemens CP 1616, restrict access to the integrated configuration web server to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BDU:2019-03005

CVE-2018-13810

Produtos afetados

Siemens Cp 1604

Siemens Cp 1616

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-13810 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13810 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-03005 · Nota de Segurança
• https://cert-portal.siemens.com/productcert/pdf/ssa-559174.pdf · Aviso do Fabricante