var-201803-2160
Vulnerability from variot
A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions < V3.15.10). Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache folders within the app's sandbox on the same mobile device. This includes HMI project cache folders of other configured WinCC OA servers. The security vulnerability could be exploited by an attacker who tricks an app user to connect to an attacker-controlled WinCC OA server. Successful exploitation requires user interaction and read/write access to the app's folder on a mobile device. The vulnerability could allow reading data from and writing data to the app's folder. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue. SIMATIC WinCC OA UI Contains an access control vulnerability.Information may be obtained and information may be altered. Siemens SIMATIC WinCC OA UI for Android is a set of SCADA system control interface based on Android platform. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201803-2160",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "simatic wincc oa ui",
"scope": "lt",
"trust": 1.0,
"vendor": "siemens",
"version": "3.15.10"
},
{
"model": "wincc oa mobile ui",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "3.15.10 (android)"
},
{
"model": "wincc oa mobile ui",
"scope": "lt",
"trust": 0.8,
"vendor": "siemens",
"version": "3.15.10 (ios)"
},
{
"model": "simatic wincc oa ui for android",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "v3.15.10"
},
{
"model": "simatic wincc oa ui for ios",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "v3.15.10"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "simatic wincc oa ui",
"version": "*"
},
{
"model": "simatic wincc oa ui",
"scope": "eq",
"trust": 0.3,
"vendor": "siemens",
"version": "0"
},
{
"model": "simatic wincc oa ui",
"scope": "ne",
"trust": 0.3,
"vendor": "siemens",
"version": "3.15.10"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "BID",
"id": "103475"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:siemens:simatic_wincc_oa_ui",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alexander Bolshev from IOActive and Ivan Yushkevich from Embedi",
"sources": [
{
"db": "BID",
"id": "103475"
}
],
"trust": 0.3
},
"cve": "CVE-2018-4844",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.4,
"id": "CVE-2018-4844",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.9,
"vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "CNVD-2018-06261",
"impactScore": 7.8,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1",
"impactScore": 7.8,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:P/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.5,
"id": "CVE-2018-4844",
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.7,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-4844",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-4844",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-4844",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2018-06261",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-722",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-4844",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
},
{
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions \u003c V3.15.10), SIMATIC WinCC OA UI for iOS (All versions \u003c V3.15.10). Insufficient limitation of CONTROL script capabilities could allow read and write access from one HMI project cache folder to other HMI project cache folders within the app\u0027s sandbox on the same mobile device. This includes HMI project cache folders of other configured WinCC OA servers. The security vulnerability could be exploited by an attacker who tricks an app user to connect to an attacker-controlled WinCC OA server. Successful exploitation requires user interaction and read/write access to the app\u0027s folder on a mobile device. The vulnerability could allow reading data from and writing data to the app\u0027s folder. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue. SIMATIC WinCC OA UI Contains an access control vulnerability.Information may be obtained and information may be altered. Siemens SIMATIC WinCC OA UI for Android is a set of SCADA system control interface based on Android platform. \nAn attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4844"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "BID",
"id": "103475"
},
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "VULMON",
"id": "CVE-2018-4844"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4844",
"trust": 3.6
},
{
"db": "SIEMENS",
"id": "SSA-822928",
"trust": 2.6
},
{
"db": "BID",
"id": "103475",
"trust": 2.6
},
{
"db": "ICS CERT",
"id": "ICSA-18-081-01",
"trust": 2.5
},
{
"db": "CNVD",
"id": "CNVD-2018-06261",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201803-722",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E9931F-39AB-11E9-AF6A-000C29342CB1",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2018-4844",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"db": "BID",
"id": "103475"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
},
{
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"id": "VAR-201803-2160",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
}
]
},
"last_update_date": "2024-11-23T23:05:09.193000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-822928",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"
},
{
"title": "Siemens SIMATIC WinCC OA UI for Android and iOS access patches for bypassing vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/123057"
},
{
"title": "Siemens SIMATIC WinCC OA UI for Android and iOS Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79322"
},
{
"title": "",
"trust": 0.1,
"url": "https://github.com/zzzteph/zzzteph "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-284",
"trust": 1.8
},
{
"problemtype": "CWE-269",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-822928.pdf"
},
{
"trust": 2.6,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-081-01"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/103475"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4844"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4844"
},
{
"trust": 0.3,
"url": "http://subscriber.communications.siemens.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/269.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/zzzteph/zzzteph"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"db": "BID",
"id": "103475"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
},
{
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"db": "BID",
"id": "103475"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
},
{
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-26T00:00:00",
"db": "IVD",
"id": "e2e9931f-39ab-11e9-af6a-000c29342cb1"
},
{
"date": "2018-03-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"date": "2018-03-20T00:00:00",
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"date": "2018-03-20T00:00:00",
"db": "BID",
"id": "103475"
},
{
"date": "2018-05-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"date": "2018-03-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-722"
},
{
"date": "2018-03-20T14:29:00.477000",
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-03-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-06261"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-4844"
},
{
"date": "2018-03-20T00:00:00",
"db": "BID",
"id": "103475"
},
{
"date": "2018-05-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-003347"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-722"
},
{
"date": "2024-11-21T04:07:34.257000",
"db": "NVD",
"id": "CVE-2018-4844"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SIMATIC WinCC OA UI Access control vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-003347"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "lack of information",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-722"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…