PT-2018-12199 · Siemens · Simatic Hmi Classic Devices+6

Published 2018-12-13 · Updated 2019-10-09 · CVE-2018-13813

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15 Update 4 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15 Update 4 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15 Update 4 SIMATIC WinCC Runtime Advanced versions prior to V15 Update 4 SIMATIC WinCC Runtime Professional versions prior to V15 Update 4 SIMATIC WinCC (TIA Portal) versions prior to V15 Update 4 SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (all versions)

Description A security issue has been identified that allows the webserver of affected HMI devices to redirect URLs to untrusted websites. To exploit this, an attacker must trick an authenticated user into clicking a malicious link. At the time of publication, there were no known public exploits of this issue.

Recommendations For SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC WinCC Runtime Advanced versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC WinCC Runtime Professional versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC WinCC (TIA Portal) versions prior to V15 Update 4, update to V15 Update 4 or later. For SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel), since all versions are affected and no specific update is mentioned, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2018-13813

Affected Products

Simatic Hmi Classic Devices

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc

Simatic Wincc Runtime Advanced

Simatic Wincc Runtime Professional

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-233109.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13813 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13813 · Security Note
• http://securityfocus.com/bid/105922 · Note