Vulnerability identifier: #VU13343

Vulnerability risk: Low

CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-4833

CWE-ID: CWE-264

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
RUGGEDCOM WiMAX
Hardware solutions / Routers & switches, VoIP, GSM, etc
SIMATIC RF182C
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X414
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-408
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-300
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-204RNA
Hardware solutions / Routers & switches, VoIP, GSM, etc
RFID 181-EIP
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-200 IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc
SCALANCE X-200
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: Siemens

Description

The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. An adjacent attacker can send a specially crafted DHCP response to a client’s DHCP request and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

RUGGEDCOM WiMAX: 4.4 - 4.5

SIMATIC RF182C: All versions

SCALANCE X414: All versions

SCALANCE X-408: All versions

SCALANCE X-300: All versions

SCALANCE X-204RNA: All versions

RFID 181-EIP: All versions

SCALANCE X-200 IRT: All versions

SCALANCE X-200: All versions

---

External links
http://cert-portal.siemens.com/productcert/pdf/ssa-181018.pdf

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.