CVE-2018-4858

Vulnerability

A vulnerability (CWE-284: Improper Access Control) exists in the IEC 61850 system configurator (all versions prior to v5.80), DIGSI 5 (all versions prior to v7.80), DIGSI 4 (all versions prior to v4.93), SICAM PAS/PQS (all versions prior to v8.11), SICAM PQ Analyzer (all versions prior to v3.11), and SICAM SCC (all versions prior to v9.02 HF3). A service in these products listens on all host network interfaces on ports 4884/TCP, 5885/TCP, or 5886/TCP and does not properly control access, allowing an attacker to send specially crafted network requests to the service [1].

Exploitation

Exploitation requires an attacker to be able to send a specially crafted network request to the vulnerable service over a network, and also requires user interaction with the service's client application on the host [1]. In order to execute arbitrary code, the attacker must first plant the code on the host by other means (e.g., social engineering or another vulnerability). The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates high attack complexity and required user interaction [1].

Impact

Successful exploitation allows an attacker to exfiltrate limited data from the system or execute code with Microsoft Windows user permissions. The vulnerability has limited impact to confidentiality and integrity of the affected system [1].

Mitigation

Siemens has released updates for all affected products: IEC 61850 system configurator update to v5.80, DIGSI 5 update to v7.80, DIGSI 4 update to v4.93, SICAM PAS/PQS update to v8.11, SICAM PQ Analyzer update to v3.11, and SICAM SCC update to v9.02 HF3. Users are recommended to update to the newest version [1]. At the time of advisory publication, no public exploitation was known [1].