var-201801-1629
Vulnerability from variot
A vulnerability has been identified in TeleControl Server Basic < V3.1. An authenticated attacker with a low-privileged account to the TeleControl Server Basic's port 8000/tcp could escalate his privileges and perform administrative operations. TeleControl Server Basic Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens AG. An attacker can leverage these issues to obtain sensitive information, bypass security restrictions and gain elevated privileges. Failed exploit attempts may result in a denial of service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201801-1629",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "telecontrol server basic",
"scope": "lt",
"trust": 1.8,
"vendor": "siemens",
"version": "3.1"
},
{
"model": "telecontrol server basics",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "v3.1"
},
{
"model": "telecontrol server basic sp2",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "3.0"
},
{
"model": "telecontrol server basic",
"scope": "eq",
"trust": 0.6,
"vendor": "siemens",
"version": "3.0"
},
{
"model": "telecontrol server basic",
"scope": "ne",
"trust": 0.6,
"vendor": "siemens",
"version": "3.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "telecontrol server basic",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "NVD",
"id": "CVE-2018-4836"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:siemens:telecontrol_server_basic:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4836"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The vendor reported this issue.",
"sources": [
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
}
],
"trust": 0.6
},
"cve": "CVE-2018-4836",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-4836",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-02347",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-4836",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-4836",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-02347",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201801-985",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability has been identified in TeleControl Server Basic \u003c V3.1. An authenticated attacker with a low-privileged account to the TeleControl Server Basic\u0027s port 8000/tcp could escalate his privileges and perform administrative operations. TeleControl Server Basic Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Siemens TeleControl Server Basic is a remote control system for Siemens equipment from Siemens AG. \nAn attacker can leverage these issues to obtain sensitive information, bypass security restrictions and gain elevated privileges. Failed exploit attempts may result in a denial of service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
},
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4836",
"trust": 3.8
},
{
"db": "BID",
"id": "102904",
"trust": 1.9
},
{
"db": "SIEMENS",
"id": "SSA-651454",
"trust": 1.9
},
{
"db": "BID",
"id": "102897",
"trust": 1.9
},
{
"db": "ICS CERT",
"id": "ICSA-18-030-02",
"trust": 1.7
},
{
"db": "CNVD",
"id": "CNVD-2018-02347",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201801-985",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E32A80-39AB-11E9-AE20-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"id": "VAR-201801-1629",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
}
]
},
"last_update_date": "2023-12-18T12:02:45.265000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SSA-651454",
"trust": 0.8,
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-651454.pdf"
},
{
"title": "Patch for Siemens TeleControl Server Basic Privilege Escalation Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/115111"
},
{
"title": "Siemens TeleControl Server Basic Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=78098"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "NVD",
"id": "CVE-2018-4836"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-651454.pdf"
},
{
"trust": 1.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-030-02"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/102897"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/102904"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4836"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4836"
},
{
"trust": 0.6,
"url": "https://support.industry.siemens.com/cs/ww/en/view/109755199"
},
{
"trust": 0.6,
"url": "http://www.siemens.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-31T00:00:00",
"db": "IVD",
"id": "e2e32a80-39ab-11e9-ae20-000c29342cb1"
},
{
"date": "2018-01-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"date": "2018-01-30T00:00:00",
"db": "BID",
"id": "102904"
},
{
"date": "2018-01-25T00:00:00",
"db": "BID",
"id": "102897"
},
{
"date": "2018-02-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"date": "2018-01-25T14:29:00.380000",
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"date": "2018-01-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-01-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-02347"
},
{
"date": "2018-01-30T00:00:00",
"db": "BID",
"id": "102904"
},
{
"date": "2018-01-25T00:00:00",
"db": "BID",
"id": "102897"
},
{
"date": "2018-04-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-001582"
},
{
"date": "2019-10-09T23:41:00.453000",
"db": "NVD",
"id": "CVE-2018-4836"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "102904"
},
{
"db": "BID",
"id": "102897"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "TeleControl Server Basic Vulnerabilities related to authorization, permissions, and access control",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-001582"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201801-985"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.