PT-2019-15333 · Siemens · Sppa-T3000 Ms3000 Migration Server

Published 2019-12-12 · Updated 2022-03-05 · CVE-2019-18313

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SPPA-T3000 MS3000 Migration Server (All versions)

Description A vulnerability has been identified that allows an attacker with network access to the MS3000 Server to gain remote code execution by sending specifically crafted objects to one of the RPC services. Note that an attacker needs to have network access to the MS3000 in order to exploit this issue. At the time of advisory publication, no public exploitation of this security issue was known.

Recommendations For all versions, there is no information about a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the RPC services to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-18313

Affected Products

Sppa-T3000 Ms3000 Migration Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-18313 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-451445.pdf · Vendor Advisory
• https://t.me/cvenotify/27788 · Telegram Post