PT-2018-12198 · Siemens · Simatic Hmi Classic Devices+6

Published 2018-12-13 · Updated 2019-10-09 · CVE-2018-13812

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15 Update 4 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15 Update 4 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15 Update 4 SIMATIC WinCC Runtime Advanced versions prior to V15 Update 4 SIMATIC WinCC Runtime Professional versions prior to V15 Update 4 SIMATIC WinCC (TIA Portal) versions prior to V15 Update 4 SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (all versions)

Description A directory traversal issue allows attackers to download arbitrary files from the device via the integrated web server. This can be exploited by an attacker with network access, requiring no user interaction or authentication, and impacts the confidentiality of the device. At the time of publication, no public exploitation of this issue was known.

Recommendations For SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC WinCC Runtime Advanced versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC WinCC Runtime Professional versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC WinCC (TIA Portal) versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-13812

Affected Products

Simatic Hmi Classic Devices

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc

Simatic Wincc Runtime Advanced

Simatic Wincc Runtime Professional

References · 4

• https://osv.dev/vulnerability/CVE-2018-13812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13812 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf · Vendor Advisory
• http://securityfocus.com/bid/105922 · Note