Siemens AG SCALANCE M875

CVE-2018-4859
HIGH 7.2

En bref

Source
NVD
EPSS
EPSS 3.74 % · centile 90 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
siemens
Statut NVD
Modified

Description

A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the web interface. The attacker must be authenticated as administrative user to exploit the security vulnerability. The vulnerability could allow an attacker to execute arbitrary code on the device. At the time of advisory publication no public exploitation of this security vulnerability was known.

Faiblesses (CWE)

  • CWE-78 — Injection de commande système

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.0HIGH 7.2CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 2.0HIGH 9.0AV:N/AC:L/Au:S/C:C/I:C/A:CNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Siemens AG · SCALANCE M875affected SCALANCE M875 All versions

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD