Siemens SINUMERIK 828D/SINUMERIK 840D sl Firewall Configuration 5900/tcp Network Request access control

Summaryinfo

A vulnerability identified as critical has been detected in Siemens SINUMERIK 828D and SINUMERIK 840D sl. Affected is an unknown function of the file 5900/tcp of the component Firewall Configuration. This manipulation as part of Network Request causes access control. This vulnerability is registered as CVE-2018-11458. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability has been found in Siemens SINUMERIK 828D and SINUMERIK 840D sl (affected version not known) and classified as critical. Affected by this vulnerability is some unknown functionality of the file 5900/tcp of the component Firewall Configuration. The manipulation as part of a Network Request leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to execute code with privileged permissions on the system by sending specially crafted network requests to port 5900/tcp. Please note that this vulnerability is only exploitable if port 5900/tcp is manually opened in the firewall configuration of network port X130. The security vulnerability could be exploited by an attacker with network access to the affected devices and port. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the VNC server. At the time of advisory publication no public exploitation of this security vulnerability was known.

The bug was discovered 12/12/2018. The weakness was published 12/12/2018 (Website). The advisory is shared at cert-portal.siemens.com. This vulnerability is known as CVE-2018-11458 since 05/25/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 06/18/2023). MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106185†). Similar entries are available at VDB-127884, VDB-127886, VDB-127887 and VDB-127888. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Siemens

Name

• SINUMERIK 828D
• SINUMERIK 840D sl

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion