CVE-2018-13810: CSRF
First published: Wed Apr 17 2019(Updated: )
A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens Simatic CP 1604 Firmware | <=2.8 | |
| Siemens Simatic CP 1604 | ||
| Siemens Simatic CP 1616 Firmware | <=2.8 | |
| Siemens CP 1616 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-13810?
CVE-2018-13810 has been rated as a high severity vulnerability due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2018-13810?
To mitigate CVE-2018-13810, ensure that you apply security patches provided by Siemens for the affected CP 1604 and CP 1616 firmware versions.
Which devices are affected by CVE-2018-13810?
CVE-2018-13810 affects all versions of Siemens CP 1604 and CP 1616 firmware up to version 2.8.
What type of attack does CVE-2018-13810 enable?
CVE-2018-13810 enables Cross-Site Request Forgery (CSRF) attacks if users are tricked into clicking malicious links.
What should users do if they suspect exploitation of CVE-2018-13810?
If exploitation of CVE-2018-13810 is suspected, users should immediately review device configurations and consider removing network access until patches are applied.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/references
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens simatic cp 1604 firmware
- version/siemens simatic cp 1604 firmware/2.8
- canonical/siemens simatic cp 1604
- canonical/siemens simatic cp 1616 firmware
- version/siemens simatic cp 1616 firmware/2.8
- canonical/siemens cp 1616 firmware