CVE-2018-13804

{"containers": {"cna": {"affected": [{"product": "SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "SIMATIC IT LMS : All versions"}, {"status": "affected", "version": "SIMATIC IT Production Suite : Versions V7.1 < V7.1 Upd3"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions < V1.2"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V1.2"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V1.3"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V2.3"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V2.4"}]}], "datePublic": "2018-12-13T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-12-14T10:57:02.000Z", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf"}, {"name": "105924", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/105924"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "productcert@siemens.com", "ID": "CVE-2018-13804", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing", "version": {"version_data": [{"version_value": "SIMATIC IT LMS : All versions"}, {"version_value": "SIMATIC IT Production Suite : Versions V7.1 < V7.1 Upd3"}, {"version_value": "SIMATIC IT UA Discrete Manufacturing : Versions < V1.2"}, {"version_value": "SIMATIC IT UA Discrete Manufacturing : Versions V1.2"}, {"version_value": "SIMATIC IT UA Discrete Manufacturing : Versions V1.3"}, {"version_value": "SIMATIC IT UA Discrete Manufacturing : Versions V2.3"}, {"version_value": "SIMATIC IT UA Discrete Manufacturing : Versions V2.4"}]}}]}, "vendor_name": "Siemens AG"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-287: Improper Authentication"}]}]}, "references": {"reference_data": [{"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf", "refsource": "CONFIRM", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf"}, {"name": "105924", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105924"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T09:14:47.168Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf"}, {"name": "105924", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/105924"}]}]}, "cveMetadata": {"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2018-13804", "datePublished": "2018-12-13T16:00:00.000Z", "dateReserved": "2018-07-10T00:00:00.000Z", "dateUpdated": "2024-08-05T09:14:47.168Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing", "vendor": "Siemens AG", "versions": [{"status": "affected", "version": "SIMATIC IT LMS : All versions"}, {"status": "affected", "version": "SIMATIC IT Production Suite : Versions V7.1 < V7.1 Upd3"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions < V1.2"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V1.2"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V1.3"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V2.3"}, {"status": "affected", "version": "SIMATIC IT UA Discrete Manufacturing : Versions V2.4"}]}], "source": "productcert@siemens.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:simatic_it_line_monitoring_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D5EA164-9BEF-4484-BE38-44FB88621DAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:simatic_it_production_suite:v7.1:*:*:*:*:*:*:*", "matchCriteriaId": "1DA44902-E2E1-4905-B079-4175B77BA6C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:*:*:*:*:*:*:*:*", "matchCriteriaId": "B80F843B-EE5E-4E6E-A55B-7645851E3C94", "versionEndIncluding": "v1.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:v1.3:*:*:*:*:*:*:*", "matchCriteriaId": "ADB0EE1B-B674-4F10-805C-E893F546F1F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:v2.3:*:*:*:*:*:*:*", "matchCriteriaId": "4FA4E503-A04B-43F9-B8F0-2CA8F4332A5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:v2.4:*:*:*:*:*:*:*", "matchCriteriaId": "3239A643-480F-4CDC-9CEF-5F1FB0FDD5D5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SIMATIC IT LMS (todas las versiones), SIMATIC IT Production Suite (versiones V7.1 anteriores a V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (versiones anteriores a V1.2), SIMATIC IT UA Discrete Manufacturing (versiones V1.2), SIMATIC IT UA Discrete Manufacturing (versiones V1.3), SIMATIC IT UA Discrete Manufacturing (versiones V2.3) y SIMATIC IT UA Discrete Manufacturing (versiones V2.4). Un atacante con acceso de red a la instalaci\u00f3n podr\u00eda omitir la autenticaci\u00f3n a nivel de aplicaci\u00f3n. Para explotar esta vulnerabilidad, un atacante debe obtener acceso de red a una instalaci\u00f3n afectada y debe obtener un usuario v\u00e1lido en el sistema. Su explotaci\u00f3n con \u00e9xito no requiere privilegios de usuario ni interacci\u00f3n. La vulnerabilidad podr\u00eda permitir que un atacante comprometa la confidencialidad, integridad y disponibilidad del sistema. En el momento de la publicaci\u00f3n del aviso, no se conoce ninguna explotaci\u00f3n p\u00fablica de la vulnerabilidad."}], "id": "CVE-2018-13804", "lastModified": "2026-06-17T01:40:11.980", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-12-13T16:29:00.210", "references": [{"source": "productcert@siemens.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105924"}, {"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105924"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "productcert@siemens.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}