CVE-2018-11453 — Incorrect Default Permissions in Siemens Simatic Step 7

CWE-276 — Incorrect Default Permissions CWE-732 — Incorrect Permission Assignment3 documents3 sources

Severity

7.8HIGHNVD

EPSS

0.0%

top 84.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Siemens Simatic Step 7 Siemens Simatic Wincc

Timeline

PublishedAug 7

Latest updateMay 13

Description

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2 Update 2), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 6), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 (All versions < V15 Update 2). Improper file permissions in the default installation of TIA Portal may allow an attacker with local file system a…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDsiemens/simatic_wincc6 versions+5

▶NVDsiemens/simatic_step_76 versions+5

🔴Vulnerability Details

GHSA

GHSA-rg7v-v5mq-rpj8: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) an↗2022-05-13

▶

CVEList

CVE-2018-11453: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) an↗2018-08-07

▶