PT-2018-16564 · Siemens · Rapidpoint 400+2

Published 2018-06-26 · Updated 2023-03-24 · CVE-2018-4845

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RAPIDLab 1200 systems versions prior to V3.3 RAPIDPoint 400 systems all versions RAPIDPoint 500 systems versions prior to V3.0 RAPIDPoint 500 systems version V2.4.X RAPIDPoint 500 systems versions prior to V2.3

Description A security issue has been identified that could allow remote attackers with local or remote credentialed access to the "Remote View" feature to elevate their privileges. This could compromise the confidentiality, integrity, and availability of the system. The attack does not require special skills or user interaction. At the time of publication, there were no known public exploitations of this issue.

Recommendations For RAPIDLab 1200 systems versions prior to V3.3, update to version V3.3 or later. For RAPIDPoint 400 systems all versions, consider disabling the "Remote View" feature until a patch is available. For RAPIDPoint 500 systems versions prior to V3.0, update to version V3.0 or later. For RAPIDPoint 500 systems version V2.4.X, consider restricting access to the "Remote View" feature until a patch is available. For RAPIDPoint 500 systems versions prior to V2.3, update to version V2.3 or later.

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2018-4845

Affected Products

Rapidlab 1200

Rapidpoint 400

Rapidpoint 500

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-4845 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4845 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-755010.pdf · Note