CVE-2018-13804

highPriorität · verfolgen · 33EPSS 0.027 · 86. PerzentilEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
2.66% (86th) EPSS
CVSS 9.3 · high
Is it mine?
30 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSIMATIC IT Production Suitecisa_csaf_ot

    Update to V7.1 Upd3. Contact Product Support to obtain the update. - Download: https://www.plm.automation.siemens.com/global/en/support/

    https://www.plm.automation.siemens.com/global/en/support/
  • BehobenSIMATIC IT UA Discrete Manufacturingcisa_csaf_ot

    Versions V2.4 The latest V2.4 release containing SIMATIC IT Administrative Tools, SIMATIC IT Basic Service, and SIMATIC IT Full Services V7.1 Upd3 is available from GTAC Download. - Download: https://download.industrysoftware.automation.siemens.com/

    https://download.industrysoftware.automation.siemens.com/
  • MitigationSIMATIC IT LMScisa_csaf_ot

    See recommendations from section Workaround and Mitigations

  • MitigationSIMATIC IT Production Suitecisa_csaf_ot

    Siemens has identified the following specific workarounds and mitigations thatcustomers can apply to reduce the risk: Restrict network access to affected installations.

  • MitigationSIMATIC IT UA Discrete Manufacturingcisa_csaf_ot

    See recommendations from section Workaround and Mitigations

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.09.3highAV:N/AC:M/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 10
v3.08.1highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 5.9
v3.07.7highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L/E:P/RL:O/RC:Csecondary · CISA US
v3.07.4highCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.7highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Lsecondary · FSTEC (BDU) RU
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-287USCWE-287USCWE-287US
04

betroffene Produkte (30)

Betroffene Produkte und Versionsbereiche.

20 von 30 angezeigt
05

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-18-317-07ICSA-18-317-07 Siemens SIMATIC IT Production Suite2018-11-13icsa · cisa_csaf_otUS

    CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

06

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2018-12-13geändert 2026-06-17
08

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan