ICSA-18-254-04 Siemens SIMATIC WinCC OA
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2018-13799US | critical9.1 | — | ||
A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected product could allow an… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationSIMATIC WinCC OA V3.14 and prior
Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk:allow manual remediation of the vulnerability fixed by WinCC OAV3.14-P021.for maintaining a secured SIMATIC WinCC OA environment. Follow the SIMATIC WinCC OA Security Guideline (available at https://portal.etm.at/index.php?option=com_phocadownload&view=category&id=52:security&Itemid=81)
https://portal.etm.at/index.php - FixedSIMATIC WinCC OA V3.14 and prior
Update to V3.14-P021 and follow the steps at https://portal.etm.at/patchdownload.php?fp=version_3.14/win64vc12/ReadmeP021.txt for adding of modifying WinCC OA users in AD environments. - Download: https://portal.etm.at/index.php?option=com_content&view=category&id=67&layout=blog&Itemid=80
https://portal.etm.at/patchdownload.php
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan