Siemens SINUMERIK 828D/SINUMERIK 840D sl CRAMFS Archive access control

Summaryinfo

A vulnerability marked as critical has been reported in Siemens SINUMERIK 828D and SINUMERIK 840D sl. Affected by this issue is some unknown functionality of the component CRAMFS Archive Handler. Performing a manipulation results in access control. This vulnerability is reported as CVE-2018-11460. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability was found in Siemens SINUMERIK 828D and SINUMERIK 840D sl (the affected version is unknown). It has been classified as critical. This affects an unknown code of the component CRAMFS Archive Handler. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A local attacker with elevated user privileges (manufact) could modify a CRAMFS archive so that after reboot the system loads the modified CRAMFS file and attacker-controlled code is executed with root privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires elevated user privileges (manufact) but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

The bug was discovered 12/12/2018. The weakness was disclosed 12/12/2018 (Website). It is possible to read the advisory at cert-portal.siemens.com. This vulnerability is uniquely identified as CVE-2018-11460 since 05/25/2018. Attacking locally is a requirement. A authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 06/18/2023). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106185†). The entries VDB-127884, VDB-127886, VDB-127888 and VDB-127889 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Siemens

Name

• SINUMERIK 828D
• SINUMERIK 840D sl

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion