Vulnerability in Siemens Sinumerik 808d V4.7

CVE-2018-11461

A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A local attacker with user privileges could use the service command application for privilege escalation to an elevated user but not root. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L.

EPSS exploit prediction

EPSS: 0.004 (26.6th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 26.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2018-11461: held from 0.004 to 0.004.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2018-11461?
CVE-2018-11461 is a medium-severity vulnerability in Siemens Sinumerik 808d V4.7, classified under CWE-264. CVSS score: 6.6/10. Published 2018-12-12.
How severe is CVE-2018-11461?
Medium severity. CVSS v3 base score is 6.6 out of 10.