CVE-2018-13814

mediumPriorität · verfolgen · 36EPSS 0.017 · 77. PerzentilEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.68% (77th) EPSS
CVSS 6.8 · medium
Is it mine?
33 products
Prüfe deine Angriffsfläche
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-26

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V14), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V14), SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F (All versions < V14), SIMATIC WinCC Runtime Advanced (All versions < V14), SIMATIC WinCC Runtime Professional (All versions < V14), SIMATIC WinCC (TIA Portal) (All versions < V14), SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (All versions). The integrated web server (port 80/tcp and port 443/tcp) of the affected devices could allow an attacker to inject HTTP headers. An attacker must trick a valid user who is authenticated to the device into clicking on a malicious link to exploit the vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)cisa_csaf_ot

    Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826

  • BehobenSIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)cisa_csaf_ot

    Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826

  • BehobenSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900Fcisa_csaf_ot

    Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826

  • BehobenSIMATIC WinCC (TIA Portal)cisa_csaf_ot

    Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826

  • BehobenSIMATIC WinCC Runtime Advancedcisa_csaf_ot

    Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826

  • BehobenSIMATIC WinCC Runtime Professionalcisa_csaf_ot

    Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826

  • MitigationSIMATIC HMI Classic Devices - TP/MP/OP/MP Mobile Panel (incl. SIPLUS variants)cisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

  • MitigationSIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)cisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

  • MitigationSIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)cisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

  • MitigationSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900Fcisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

  • MitigationSIMATIC WinCC (TIA Portal)cisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

  • MitigationSIMATIC WinCC Runtime Advancedcisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

  • MitigationSIMATIC WinCC Runtime Professionalcisa_csaf_ot

    Deactivate the web server if not required. The web server is disabled by default.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.3–8.8

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 6.4
v3.08.8highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9
v3.08.1highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:Csecondary · CISA US
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USprimärCWE-113USCWE-113US
04

betroffene Produkte (33)

Betroffene Produkte und Versionsbereiche.

20 von 33 angezeigt
05

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-18-317-03Siemens SIMATIC Panels and SIMATIC WinCC (TIA Portal)2018-11-13icsa · cisa_csaf_otUS

    As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2018-12-13geändert 2026-06-17
09

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan