CVE-2018-4844

Severity Score

6.7

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache folders within the app's sandbox on the same mobile device. This includes HMI project cache folders of other configured WinCC OA servers. The security vulnerability could be exploited by an attacker who tricks an app user to connect to an attacker-controlled WinCC OA server. Successful exploitation requires user interaction and read/write access to the app's folder on a mobile device. The vulnerability could allow reading data from and writing data to the app's folder. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.

Se ha identificado una vulnerabilidad en SIMATIC WinCC OA UI para Android (todas las versiones anteriores a V3.15.10) y SIMATIC WinCC OA UI para iOS (odas las versiones anteriores a V3.15.10). La limitación insuficiente de capacidades de script CONTROL podría permitir el acceso de lectura y escritura de una carpeta de caché de proyecto HMI a otras carpetas de caché de proyecto HMI en el sandbox de la aplicación en el mismo dispositivo móvil. Esto incluye carpetas de caché de proyecto HMI de otros servidores WinCC OA configurados. La vulnerabilidad de seguridad podría ser explotada por un atacante que engaña a un usuario de la aplicación para que se conecte a un servidor WinCC OA controlado por el atacante. La explotación con éxito requiere de interacción de usuario y acceso de lectura/escritura a la carpeta de la aplicación en un dispositivo móvil. La vulnerabilidad podría permitir la lectura y escritura de datos en la carpeta de la aplicación. En el momento de la publicación del advisory, no se conoce ninguna explotación pública de la vulnerabilidad de seguridad. Siemens confirma la vulnerabilidad de seguridad y proporciona mitigaciones para resolver el problema de seguridad.

*Credits: N/A

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Adjacent

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-01-02 CVE Reserved
2018-03-20 CVE Published
2023-03-08 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-269: Improper Privilege Management
CWE-284: Improper Access Control

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/103475	Broken Link
https://ics-cert.us-cert.gov/advisories/ICSA-18-081-01	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf	2023-03-24

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"		Simatic Wincc Oa Ui Search vendor "Siemens" for product "Simatic Wincc Oa Ui"				< 3.15.10 Search vendor "Siemens" for product "Simatic Wincc Oa Ui" and version " < 3.15.10"		android		Affected
Siemens Search vendor "Siemens"		Simatic Wincc Oa Ui Search vendor "Siemens" for product "Simatic Wincc Oa Ui"				< 3.15.10 Search vendor "Siemens" for product "Simatic Wincc Oa Ui" and version " < 3.15.10"		iphone_os		Affected