What is the severity of CVE-2018-4834?

The severity of CVE-2018-4834 is classified as high due to potential unauthorized access and manipulation of system functions.

How do I fix CVE-2018-4834?

To fix CVE-2018-4834, update affected Siemens PXC firmware to version 4.10.111, 5.0.171, 5.10.69, or 6.0.204 or later.

Which Siemens products are affected by CVE-2018-4834?

The affected products include Siemens Desigo PXC00-E.D firmware versions prior to 4.10.111, 5.00 prior to 5.0.171, and others specified in the CVE description.

What are the potential impacts of CVE-2018-4834?

The potential impacts include unauthorized access to the control systems, which may lead to operational disruptions or safety risks.

Is there a workaround for CVE-2018-4834 if I cannot update immediately?

Currently, there are no documented workarounds for CVE-2018-4834, so upgrading to the latest firmware is strongly advised.

Vulnerability/
CVE-2018-4834

critical

CWE

434 306

24/1/2018

17/9/2024

CVE-2018-4834: Malicious File Upload

First published: Wed Jan 24 2018(Updated: )

A vulnerability has been identified in Desigo PXC00-E.D V4.10 (All versions < V4.10.111), Desigo PXC00-E.D V5.00 (All versions < V5.0.171), Desigo PXC00-E.D V5.10 (All versions < V5.10.69), Desigo PXC00-E.D V6.00 (All versions < V6.0.204), Desigo PXC00/64/128-U V4.10 (All versions < V4.10.111 only with web module), Desigo PXC00/64/128-U V5.00 (All versions < V5.0.171 only with web module), Desigo PXC00/64/128-U V5.10 (All versions < V5.10.69 only with web module), Desigo PXC00/64/128-U V6.00 (All versions < V6.0.204 only with web module), Desigo PXC001-E.D V4.10 (All versions < V4.10.111), Desigo PXC001-E.D V5.00 (All versions < V5.0.171), Desigo PXC001-E.D V5.10 (All versions < V5.10.69), Desigo PXC001-E.D V6.00 (All versions < V6.0.204), Desigo PXC100-E.D V4.10 (All versions < V4.10.111), Desigo PXC100-E.D V5.00 (All versions < V5.0.171), Desigo PXC100-E.D V5.10 (All versions < V5.10.69), Desigo PXC100-E.D V6.00 (All versions < V6.0.204), Desigo PXC12-E.D V4.10 (All versions < V4.10.111), Desigo PXC12-E.D V5.00 (All versions < V5.0.171), Desigo PXC12-E.D V5.10 (All versions < V5.10.69), Desigo PXC12-E.D V6.00 (All versions < V6.0.204), Desigo PXC200-E.D V4.10 (All versions < V4.10.111), Desigo PXC200-E.D V5.00 (All versions < V5.0.171), Desigo PXC200-E.D V5.10 (All versions < V5.10.69), Desigo PXC200-E.D V6.00 (All versions < V6.0.204), Desigo PXC22-E.D V4.10 (All versions < V4.10.111), Desigo PXC22-E.D V5.00 (All versions < V5.0.171), Desigo PXC22-E.D V5.10 (All versions < V5.10.69), Desigo PXC22-E.D V6.00 (All versions < V6.0.204), Desigo PXC22.1-E.D V4.10 (All versions < V4.10.111), Desigo PXC22.1-E.D V5.00 (All versions < V5.0.171), Desigo PXC22.1-E.D V5.10 (All versions < V5.10.69), Desigo PXC22.1-E.D V6.00 (All versions < V6.0.204), Desigo PXC36.1-E.D V4.10 (All versions < V4.10.111), Desigo PXC36.1-E.D V5.00 (All versions < V5.0.171), Desigo PXC36.1-E.D V5.10 (All versions < V5.10.69), Desigo PXC36.1-E.D V6.00 (All versions < V6.0.204), Desigo PXC50-E.D V4.10 (All versions < V4.10.111), Desigo PXC50-E.D V5.00 (All versions < V5.0.171), Desigo PXC50-E.D V5.10 (All versions < V5.10.69), Desigo PXC50-E.D V6.00 (All versions < V6.0.204), Desigo PXM20-E V4.10 (All versions < V4.10.111), Desigo PXM20-E V5.00 (All versions < V5.0.171), Desigo PXM20-E V5.10 (All versions < V5.10.69), Desigo PXM20-E V6.00 (All versions < V6.0.204). A remote attacker with network access to the device could potentially upload a new firmware image to the devices without prior authentication.

Credit: productcert@siemens.com

Affected Software	Affected Version	How to fix
Siemens PXC12/22/36-E.D Firmware	<6.00.204
Siemens PXC12/22/36-E.D
Siemens Desigo PXC00/50/100/200-E.D Firmware	<6.00.204
Siemens PXC00/50/100/200-E.D
Siemens PXC00/64/128-U Firmware	<6.00.204
Siemens PXC00/64/128-U
Siemens Desigo PXC001-E.D	<6.00.204
Siemens Desigo PXC001-E.D
Siemens PXM20-E	<6.00.204
Siemens PXM20-E Firmware

Never miss a vulnerability like this again

Reference Links

https://cert-portal.siemens.com/productcert/pdf/ssa-824231.pdf

Frequently Asked Questions

What is the severity of CVE-2018-4834?
The severity of CVE-2018-4834 is classified as high due to potential unauthorized access and manipulation of system functions.
How do I fix CVE-2018-4834?
To fix CVE-2018-4834, update affected Siemens PXC firmware to version 4.10.111, 5.0.171, 5.10.69, or 6.0.204 or later.
Which Siemens products are affected by CVE-2018-4834?
The affected products include Siemens Desigo PXC00-E.D firmware versions prior to 4.10.111, 5.00 prior to 5.0.171, and others specified in the CVE description.
What are the potential impacts of CVE-2018-4834?
The potential impacts include unauthorized access to the control systems, which may lead to operational disruptions or safety risks.
Is there a workaround for CVE-2018-4834 if I cannot update immediately?
Currently, there are no documented workarounds for CVE-2018-4834, so upgrading to the latest firmware is strongly advised.

agent/type
agent/author
agent/references
agent/weakness
agent/severity
agent/description
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/first-publish-date
agent/event
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
agent/softwarecombine
vendor/siemens
canonical/siemens pxc12/22/36-e.d firmware
canonical/siemens pxc12/22/36-e.d
canonical/siemens desigo pxc00/50/100/200-e.d firmware
canonical/siemens pxc00/50/100/200-e.d
canonical/siemens pxc00/64/128-u firmware
canonical/siemens pxc00/64/128-u
canonical/siemens desigo pxc001-e.d
canonical/siemens pxm20-e
canonical/siemens pxm20-e firmware

Frequently Asked Questions

What is the severity of CVE-2018-4834?
The severity of CVE-2018-4834 is classified as high due to potential unauthorized access and manipulation of system functions.
How do I fix CVE-2018-4834?
To fix CVE-2018-4834, update affected Siemens PXC firmware to version 4.10.111, 5.0.171, 5.10.69, or 6.0.204 or later.
Which Siemens products are affected by CVE-2018-4834?
The affected products include Siemens Desigo PXC00-E.D firmware versions prior to 4.10.111, 5.00 prior to 5.0.171, and others specified in the CVE description.
What are the potential impacts of CVE-2018-4834?
The potential impacts include unauthorized access to the control systems, which may lead to operational disruptions or safety risks.
Is there a workaround for CVE-2018-4834 if I cannot update immediately?
Currently, there are no documented workarounds for CVE-2018-4834, so upgrading to the latest firmware is strongly advised.

CVE-2018-4834: Malicious File Upload

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2018-4834?

How do I fix CVE-2018-4834?

Which Siemens products are affected by CVE-2018-4834?

What are the potential impacts of CVE-2018-4834?

Is there a workaround for CVE-2018-4834 if I cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2018-4834?

How do I fix CVE-2018-4834?

Which Siemens products are affected by CVE-2018-4834?

What are the potential impacts of CVE-2018-4834?

Is there a workaround for CVE-2018-4834 if I cannot update immediately?