CVE-2018-4861: Infoleak
First published: Tue Jun 26 2018(Updated: )
A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could potentially read and download arbitrary files from the device's file system. Successful exploitation requires that the attacker has network access to the web interface. The attacker must be authenticated as administrative user to exploit the security vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens SCALANCE M875 | ||
| Siemens Scalance M875 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2018-4861?
CVE-2018-4861 has been classified as a high severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2018-4861?
To remediate CVE-2018-4861, it is recommended to restrict access to the web interface and apply any available firmware updates from Siemens.
Who is affected by CVE-2018-4861?
CVE-2018-4861 affects all versions of the Siemens SCALANCE M875 devices accessing the web interface.
What type of attack is CVE-2018-4861 related to?
CVE-2018-4861 is related to an authenticated remote file access attack that can lead to unauthorized file downloads.
What are the potential impacts of exploiting CVE-2018-4861?
Exploitation of CVE-2018-4861 can result in unauthorized access to sensitive files on the SCALANCE M875 device.
- agent/weakness
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/references
- agent/author
- agent/softwarecombine
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/siemens
- canonical/siemens scalance m875 firmware
- canonical/siemens scalance m875