icsa-18-093-01
Vulnerability from csaf_cisa
Published
2018-03-28 00:00
Modified
2018-04-03 00:00
Summary
ICSA-18-093-01 Siemens Building Technologies Products (Update A)

Notes

Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Advisory Conversion Disclaimer
This CISA CSAF advisory was converted from Siemens ProductCERT's TXT advisory.
Critical infrastructure sectors
Multiple
Countries/areas deployed
Worldwide
Company headquarters location
Germany
Recommended Practices
CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.
Recommended Practices
Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.
Recommended Practices
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
Recommended Practices
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.
Recommended Practices
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
General Recommendations
As a general security measure Siemens strongly recommends to protectnetwork access to affected products with appropriate mechanisms. It isadvised to follow recommended security practices in order to run thedevices in a protected IT environment.
Terms of Use
Siemens Security Advisories are subject to the terms and conditions containedin Siemens' underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter "License Terms"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens' Global Website(https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.


To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Sergey Temnikov",
          "Vladimir Dashchenko"
        ],
        "organization": "Kaspersky Lab ICS CERT",
        "summary": "coordinating disclosure"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s TXT advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "As a general security measure Siemens strongly recommends to protectnetwork access to affected products with appropriate mechanisms. It isadvised to follow recommended security practices in order to run thedevices in a protected IT environment.",
        "title": "General Recommendations"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions containedin Siemens\u0027 underlying license terms or other applicable agreements previouslyagreed to with Siemens (hereinafter \"License Terms\"). To the extent applicableto information, software or documentation made available in or through aSiemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website(https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), inparticular Sections 8-10 of the Terms of Use, shall apply additionally. In caseof conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-727467: Vulnerabilities in Building Technologies Products",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-727467.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-093-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/refs/heads/develop/csaf_files/OT/white/2018/icsa-18-093-01.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-18-093-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-093-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "ICSA-18-093-01 Siemens Building Technologies Products (Update A)",
    "tracking": {
      "current_release_date": "2018-04-03T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-18-093-01",
      "initial_release_date": "2018-03-28T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2018-03-28T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2018-04-03T00:00:00.000000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added download link for LMU"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV2.1_SP3_2.1.670",
                "product": {
                  "name": "License Management System (LMS)",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "License Management System (LMS)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "V1.0.4 | V1.1",
                "product": {
                  "name": "Annual Shading",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Annual Shading"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "MP1.1 Build 845 | MP1.15 Build 360 | MP1.16 Build 055 | MP1.2 Build 850 | MP1.2.1 Build 318 | and MP2.1 Build 965",
                "product": {
                  "name": "Desigo ABT",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo ABT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "MP1.1 | MP2.0 | MP2.1 | MP3.0",
                "product": {
                  "name": "Desigo CC",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo CC"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "V6.10.140",
                "product": {
                  "name": "Desigo Configuration Manager (DCM)",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo Configuration Manager (DCM)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "V5.00.204 | V5.00.260 | V5.10.142 | V5.10.212 | V6.00.184 | V6.00.342 | V6.10.172",
                "product": {
                  "name": "Desigo XWP",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Desigo XWP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "V1.1, V1.2, and V1.3",
                "product": {
                  "name": "SiteIQ Analytics",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "SiteIQ Analytics"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "V1.1",
                "product": {
                  "name": "Siveillance Identity",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Identity"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-11496",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Malformed ASN1 streams in V2C and similar input files can be used to generate stack-based buffer overflows. The vulnerability could allow arbitrary code execution.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11496"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-11497",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Language packs containing malformed filenames could lead to a stack buffer overflow. The vulnerability could allow arbitrary code execution.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11497"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-11498",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Zipped language packs with invalid HTML files could lead to NULL pointer access. The vulnerability could cause denial of service of the remote process.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-11498"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-12818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A stack overflow flaw in the custom XML-parser could allow remote denial of service.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12818"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-12819",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Remote manipulation of the language pack updater could allow NTLM-relay attacks.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12819"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-12820",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Arbitrary memory read from controlled memory pointer could allow remote denial of service.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12820"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-12821",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": " A memory corruption flaw could allow remote code execution.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12821"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-12822",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The administrative interface can be remotely enabled and disabled without authentication. This could increase the attack surface.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-12822"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.0.4, V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0002"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1 Build 845, MP1.15 Build 360, MP1.16 Build 055, MP1.2 Build 850, MP1.2.1 Build 318, and MP2.1 Build 965 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "MP1.1, MP2.0, MP2.1, and MP3.0 Install LMS V2.1 SP4 (2.1.681) or newer. Customers with MP2.1 or older need to upgrade ALM Manager before applying the update to LMS. - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V6.10.140 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V5.00.204, V5.00.260, V5.10.142, V5.10.212, V6.00.184, V6.00.342, and V6.10.172 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1, V1.2, and V1.3 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        },
        {
          "category": "vendor_fix",
          "details": "V1.1 Install LMS V2.1 SP4 (2.1.681) or newer - Download: To update to 2.1.681 follow the instructions at https://support.industry.siemens.com/cs/document/109479834 or contact your local Siemens representative or the Siemens customer support.",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://support.industry.siemens.com/cs/document/109479834"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.