Privilege escalation in Siemens SCALANCE X, RUGGEDCOM WiMAX, RFID 181-EIP, and SIMATIC RF182C
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2018-4833 |
| CWE-ID | CWE-264 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
RUGGEDCOM WiMAX Hardware solutions / Routers & switches, VoIP, GSM, etc SIMATIC RF182C Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X414 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X-408 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X-300 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X-204RNA Hardware solutions / Routers & switches, VoIP, GSM, etc RFID 181-EIP Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X-200 IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X-200 Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains one high risk vulnerability.
1) Privilege escalation
EUVDB-ID: #VU13343
Risk: Low
CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-4833
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges on the target system.
The vulnerability exists due to insufficient validation of user-supplied input. An adjacent attacker can send a specially crafted DHCP response to a client’s DHCP request and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall update from vendor's website.
RUGGEDCOM WiMAX: 4.4 - 4.5
SIMATIC RF182C: All versions
SCALANCE X414: All versions
SCALANCE X-408: All versions
SCALANCE X-300: All versions
SCALANCE X-204RNA: All versions
RFID 181-EIP: All versions
SCALANCE X-200 IRT: All versions
SCALANCE X-200: All versions
External linkshttp://cert-portal.siemens.com/productcert/pdf/ssa-181018.pdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
