VulnerabilityModified

CVE-2018-13810

A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions).

MEDIUM 6.5EPSS 0.51%

Does this matter?

Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: 0.51% probability · 42th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: siemens/cp 1604 firmware · siemens/cp 1616 firmware
Source: productcert@siemens.com

References

https://cert-portal.siemens.com/productcert/pdf/ssa-559174.pdfVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-559174.pdfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.