PT-2018-12200 · Siemens · Simatic Hmi Classic Devices+6

Published 2018-12-13 · Updated 2019-10-09 · CVE-2018-13814

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V14 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V14 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V14 SIMATIC WinCC Runtime Advanced versions prior to V14 SIMATIC WinCC Runtime Professional versions prior to V14 SIMATIC WinCC (TIA Portal) versions prior to V14 SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (all versions)

Description The issue allows an attacker to inject HTTP headers through the integrated web server of the affected devices, which listen on port 80/tcp and port 443/tcp. To exploit this, an attacker must trick a valid user who is authenticated to the device into clicking on a malicious link. There are no known public exploitations of this security issue at the time of advisory publication.

Recommendations For SIMATIC HMI Comfort Panels 4" - 22" versions prior to V14, update to version V14 or later. For SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V14, update to version V14 or later. For SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V14, update to version V14 or later. For SIMATIC WinCC Runtime Advanced versions prior to V14, update to version V14 or later. For SIMATIC WinCC Runtime Professional versions prior to V14, update to version V14 or later. For SIMATIC WinCC (TIA Portal) versions prior to V14, update to version V14 or later. For SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel), since all versions are affected and no specific fix version is mentioned, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

CWE-113

Related Identifiers

CVE-2018-13814

Affected Products

Simatic Hmi Classic Devices

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc

Simatic Wincc Runtime Advanced

Simatic Wincc Runtime Professional

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-13814 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13814 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-944083.pdf · Vendor Advisory
• http://securityfocus.com/bid/105931 · Note