Siemens SPPA-T3000 Application Server RMI improper authentication

Summaryinfo

A vulnerability marked as problematic has been reported in Siemens SPPA-T3000 Application Server. This impacts an unknown function of the component RMI. Performing a manipulation results in improper authentication. This vulnerability was named CVE-2019-18318. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in Siemens SPPA-T3000 Application Server (Application Server Software) (the affected version is unknown). This affects an unknown code of the component RMI. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on availability. The summary by CVE is:

A vulnerability has been identified in SPPA-T3000 Application Server (All versions). An attacker with network access to the Application Server can cause a Denial-of-Service condition by sending specifically crafted objects via RMI. This vulnerability is independent from CVE-2019-18317 and CVE-2019-18319. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

The weakness was presented 12/12/2019. This vulnerability is uniquely identified as CVE-2019-18318 since 10/23/2019. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/11/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-147125, VDB-147124, VDB-147122 and VDB-147121 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Application Server Software

Vendor

• Siemens

Name

• SPPA-T3000 Application Server

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion