Siemens CP 1604 and 1616 <= v2.8 Cross-Site Request Forgery

medium Nessus Network Monitor Plugin ID 720259

Synopsis

The integrated configuration web server of the affected CP devices could allow a cross-site request forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link.

Description

A CWE-352 vulnerability has been identified in CP 1604 (All versions <= v2.8), CP 1616 (All versions <= v2.8). The integrated configuration web server of the affected CP devices could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. At the time of advisory publication no public exploitation of this vulnerability was known.

Solution

Perform vendor recommended mitigations and apply available vendor upgrades.

Plugin Details

Severity: Medium

ID: 720259

Family: SCADA

Published: 6/5/2019

Updated: 9/30/2019

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 4/17/2019

Vulnerability Publication Date: 4/17/2019

Reference Information

CVE: CVE-2018-13810

Detections

Analytics