CVE Vulnerability

CVE-2018-13811

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All Versions < V15.1). Password hashes with insufficient computational effort could allow an attacker to access to a project file and reconstruct passwords. The vulnerability could be exploited by an attacker with local access to the project file. No user interaction is required to exploit the vulnerability. The vulnerability could allow the attacker to obtain certain passwords from the project. At the time of advisory publication no public exploitation of this vulnerability was known.

2.1 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-621493.pdf Vendor Advisory
http://www.securityfocus.com/bid/105926 Third Party Advisory VDB Entry
Configurations

Configuration 1

cpe:2.3:a:siemens:simatic_step_7_(tia_portal):*:*:*:*:*:*:*:*
Information

Published : 2018-12-13 04:29

Updated : 2019-10-09 11:34

NVD link : CVE-2018-13811

Mitre link : CVE-2018-13811

Products Affected
No products.
CWE
CWE-200