PT-2018-12195 · Siemens · Simatic S7-1200 Cpu

Published 2018-10-10 · Updated 2019-10-09 · CVE-2018-13800

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC S7-1200 CPU family versions prior to V4.2.3

Description A security issue has been identified that could allow a Cross-Site Request Forgery (CSRF) attack through the web interface. This attack requires user interaction by a legitimate user who must be authenticated to the web interface. If successful, an attacker could trigger actions via the web interface that the legitimate user is allowed to perform, potentially allowing the attacker to read or modify parts of the device configuration.

Recommendations For SIMATIC S7-1200 CPU family versions prior to V4.2.3, update to version V4.2.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-13800

Affected Products

Simatic S7-1200 Cpu

References · 4

• https://osv.dev/vulnerability/CVE-2018-13800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13800 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-507847.pdf · Vendor Advisory
• http://securityfocus.com/bid/105542 · Note