CVE-2018-13804
Estado: ModificadaAlta (8.1)—
A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication.
Leer descripción completaMostrar menos
In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.66%
- Percentil entre todas las CVEs puntuadas: 85
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)
CWE
- CWE-287
- NVD-CWE-noinfo
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-13804",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "productcert@siemens.com",
"affectedData": [
{
"vendor": "Siemens AG",
"product": "SIMATIC IT LMS, SIMATIC IT Production Suite, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing, SIMATIC IT UA Discrete Manufacturing",
"versions": [
{
"status": "affected",
"version": "SIMATIC IT LMS : All versions"
},
{
"status": "affected",
"version": "SIMATIC IT Production Suite : Versions V7.1 < V7.1 Upd3"
},
{
"status": "affected",
"version": "SIMATIC IT UA Discrete Manufacturing : Versions < V1.2"
},
{
"status": "affected",
"version": "SIMATIC IT UA Discrete Manufacturing : Versions V1.2"
},
{
"status": "affected",
"version": "SIMATIC IT UA Discrete Manufacturing : Versions V1.3"
},
{
"status": "affected",
"version": "SIMATIC IT UA Discrete Manufacturing : Versions V2.3"
},
{
"status": "affected",
"version": "SIMATIC IT UA Discrete Manufacturing : Versions V2.4"
}
]
}
]
}
],
"published": "2018-12-13T16:29:00.210",
"references": [
{
"url": "http://www.securityfocus.com/bid/105924",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "productcert@siemens.com"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf",
"tags": [
"Vendor Advisory"
],
"source": "productcert@siemens.com"
},
{
"url": "http://www.securityfocus.com/bid/105924",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-886615.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "productcert@siemens.com",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in SIMATIC IT LMS (All versions), SIMATIC IT Production Suite (Versions V7.1 < V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (Versions < V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.2), SIMATIC IT UA Discrete Manufacturing (Versions V1.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.3), SIMATIC IT UA Discrete Manufacturing (Versions V2.4). An attacker with network access to the installation could bypass the application-level authentication. In order to exploit the vulnerability, an attacker must obtain network access to an affected installation and must obtain a valid username to the system. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this vulnerability was known."
},
{
"lang": "es",
"value": "Se ha identificado una vulnerabilidad en SIMATIC IT LMS (todas las versiones), SIMATIC IT Production Suite (versiones V7.1 anteriores a V7.1 Upd3), SIMATIC IT UA Discrete Manufacturing (versiones anteriores a V1.2), SIMATIC IT UA Discrete Manufacturing (versiones V1.2), SIMATIC IT UA Discrete Manufacturing (versiones V1.3), SIMATIC IT UA Discrete Manufacturing (versiones V2.3) y SIMATIC IT UA Discrete Manufacturing (versiones V2.4). Un atacante con acceso de red a la instalación podría omitir la autenticación a nivel de aplicación. Para explotar esta vulnerabilidad, un atacante debe obtener acceso de red a una instalación afectada y debe obtener un usuario válido en el sistema. Su explotación con éxito no requiere privilegios de usuario ni interacción. La vulnerabilidad podría permitir que un atacante comprometa la confidencialidad, integridad y disponibilidad del sistema. En el momento de la publicación del aviso, no se conoce ninguna explotación pública de la vulnerabilidad."
}
],
"lastModified": "2026-06-17T01:40:11.980",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:siemens:simatic_it_line_monitoring_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6D5EA164-9BEF-4484-BE38-44FB88621DAF"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_it_production_suite:v7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DA44902-E2E1-4905-B079-4175B77BA6C1"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B80F843B-EE5E-4E6E-A55B-7645851E3C94",
"versionEndIncluding": "v1.2"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:v1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADB0EE1B-B674-4F10-805C-E893F546F1F5"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:v2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4FA4E503-A04B-43F9-B8F0-2CA8F4332A5E"
},
{
"criteria": "cpe:2.3:a:siemens:simatic_it_ua_discrete_manufacturing:v2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3239A643-480F-4CDC-9CEF-5F1FB0FDD5D5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "productcert@siemens.com"
}