CVE-2018-11454 — Incorrect Default Permissions in Siemens Simatic Step 7

CWE-276 — Incorrect Default Permissions CWE-732 — Incorrect Permission Assignment3 documents3 sources

Severity

8.6HIGHNVD

EPSS

0.1%

top 82.23%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Siemens Simatic Step 7 Siemens Simatic Wincc

Timeline

PublishedAug 7

Latest updateMay 13

Description

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2 Update 2), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 6), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 (All versions < V15 Update 2). Improper file permissions in the default installation of TIA Portal may allow an attacker with local file system a…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HExploitability: 1.8 | Impact: 6.0

Affected Packages2 packages

▶NVDsiemens/simatic_wincc6 versions+5

▶NVDsiemens/simatic_step_76 versions+5

🔴Vulnerability Details

GHSA

GHSA-9qvc-rfh7-2xv6: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) an↗2022-05-13

▶

CVEList

CVE-2018-11454: A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) an↗2018-08-07

▶