CVE-2018-16890
mediumpriority · track · 42EPSS 0.054 · 93 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSINEMA Remote Connect Clientcisa_csaf_ot
Turn off NTLM authentication to mitigate CVE-2018-16890 and CVE-2019-3822
- FixedSINEMA Remote Connect Servercisa_csaf_ot
Turn off NTLM authentication to mitigate CVE-2018-16890 and CVE-2019-3822
- FixedSINEMA Remote Connect Clientcisa_csaf_ot
Update to V2.0 HF1
- MitigationSINEMA Remote Connect Clientcisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSINEMA Remote Connect Servercisa_csaf_ot
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
- MitigationSINEMA Remote Connect Clientcisa_csaf_ot
Turn off NTLM authentication to mitigate CVE-2018-16890
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
- michelleamesquita/CVE-2018-16890CVE-2018-16890PoC · poc_in_github
affected products (35)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-1640cURL: Mehrere SchwachstellenDeutsch2019-02-05csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Informationen offenzulegen oder einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2025-1212Oracle Communications Applications: Mehrere SchwachstellenDeutsch2019-04-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um dadurch die Integrität, Vertraulichkeit und Verfügbarkeit zu gefährden.
- WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.
- ICSA-19-099-04Siemens SINEMA Remote Connect (Update A)2019-04-09icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to circumvent the system authorization for certain functionalities, and to execute privileged functions.
- ICSA-21-068-10Siemens SCALANCE and SIMATIC libcurl (Update B)2019-04-09icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
- CURL-CVE-2018-16890NTLM type-2 out-of-bounds buffer read2019-02-06vendor · osvUS
libcurl contains a heap buffer out-of-bounds read flaw. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (51)
External citations — patches, advisories, analysis.
- http://curl.haxx.se/cnnvd
- http://www.ibm.com/support/docview.wsscnnvd
- http://www.securityfocus.com/bid/106947cnnvd
- https://access.redhat.com/errata/RHSA-2019:3701cnnvd
- https://access.redhat.com/security/cve/cve-2018-16890cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdfcnnvd
- https://curl.haxx.se/docs/CVE-2018-16890.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan