CVE-2018-13810: CSRF
A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13810?
CVE-2018-13810 has been rated as a high severity vulnerability due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2018-13810?
To mitigate CVE-2018-13810, ensure that you apply security patches provided by Siemens for the affected CP 1604 and CP 1616 firmware versions.
Which devices are affected by CVE-2018-13810?
CVE-2018-13810 affects all versions of Siemens CP 1604 and CP 1616 firmware up to version 2.8.
What type of attack does CVE-2018-13810 enable?
CVE-2018-13810 enables Cross-Site Request Forgery (CSRF) attacks if users are tricked into clicking malicious links.
What should users do if they suspect exploitation of CVE-2018-13810?
If exploitation of CVE-2018-13810 is suspected, users should immediately review device configurations and consider removing network access until patches are applied.