PT-2018-1570 · Siemens · Siemens Td Keypad Designer
Published
2018-09-11
·
Updated
2019-10-09
·
CVE-2018-13806
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
SIEMENS TD Keypad Designer (All versions)
Description
A DLL hijacking issue exists in SIEMENS TD Keypad Designer, allowing an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access to the directory containing the TD project file to exploit this issue. A legitimate user with higher privileges than the attacker must open the TD project for this issue to be exploited. At the time of advisory publication, no public exploitation of this security issue was known. The vulnerability is related to an uncontrolled DLL search path, which can be exploited by placing a DLL in the TD project file directory.
Recommendations
For all versions, consider restricting access to the directory containing the TD project file to prevent an attacker from gaining write access, and ensure that only trusted users with the necessary privileges can open TD projects. As a temporary workaround, consider implementing additional security measures to monitor and control the execution of code with user permissions. At the moment, there is no information about a newer version that contains a fix for this issue.
Fix
Uncontrolled Search Path Element
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Siemens Td Keypad Designer