Uncaught exception in Siemens products - CVE-2018-11464
Published: December 12, 2018 / Updated: December 12, 2018
Vulnerability identifier: #VU16511
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-11464
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to uncaught exception if Port 5900/TCP is manually opened in the firewall configuration of network Port X130. A remote unauthenticated attacker can cause a denial-of-service condition of the VNC server.
Affected software
SINUMERIK 808D
SINUMERIK 840D
SINUMERIK 828D
SINUMERIK 840D
SINUMERIK 828D
How to mitigate CVE-2018-11464
Update SINUMERIK 828D to version 4.7 SP6 HF1.
Update SINUMERIK 840D to version 4.7 SP6 HF5 or 4.8 SP3.
Update SINUMERIK 840D to version 4.7 SP6 HF5 or 4.8 SP3.
SINUMERIK 828D - update to 4.7 SP6 HF1
SINUMERIK 840D - addressed in versions 4.7 SP6 HF5, 4.8 SP3
SINUMERIK 840D - addressed in versions 4.7 SP6 HF5, 4.8 SP3