GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CNVD-2018-01794

Vulnerability from cnvd - Published: 2018-01-25
VLAI
Title
Siemens DESIGO PX固件文件上传漏洞
Description
SIEMENS楼宇自控系统Desigo PX可编程自动化站提供灵活的解决方案，能够发出报警信号、基于时间的日志记录程序和趋势，可随时修改或扩展。 Siemens DESIGO PX固件存在文件上传漏洞，未经身份验证的远程攻击者利用该漏洞上传恶意固件。
Severity
高
Patch Name
Siemens DESIGO PX固件文件上传漏洞的补丁
Patch Description
SIEMENS楼宇自控系统Desigo PX可编程自动化站提供灵活的解决方案，能够发出报警信号、基于时间的日志记录程序和趋势，可随时修改或扩展。 Siemens DESIGO PX固件存在文件上传漏洞，未经身份验证的远程攻击者利用该漏洞上传恶意固件。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： https://www.siemens.com/cert/advisories

Reference
https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-824231.pdf
Impacted products
Name
['Siemens Desigo Automation Controllers Compact PXC12/22/36-E.D <6.00.204', 'Siemens Desigo Automation Controllers Modular PXC00/50/100/200-E.D <6.00.204', 'Siemens Desigo Automation Controllers PXC00/64/128-U with Web module <6.00.204', 'Siemens Desigo Operator Unit PXM20-E <6.00.204']
Show details on source website
To clipboard 

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-4834"
    }
  },
  "description": "SIEMENS\u697c\u5b87\u81ea\u63a7\u7cfb\u7edfDesigo PX\u53ef\u7f16\u7a0b\u81ea\u52a8\u5316\u7ad9\u63d0\u4f9b\u7075\u6d3b\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u80fd\u591f\u53d1\u51fa\u62a5\u8b66\u4fe1\u53f7\u3001\u57fa\u4e8e\u65f6\u95f4\u7684\u65e5\u5fd7\u8bb0\u5f55\u7a0b\u5e8f\u548c\u8d8b\u52bf\uff0c\u53ef\u968f\u65f6\u4fee\u6539\u6216\u6269\u5c55\u3002 \r\n\r\nSiemens DESIGO PX\u56fa\u4ef6\u5b58\u5728\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff0c\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u4e0a\u4f20\u6076\u610f\u56fa\u4ef6\u3002",
  "discovererName": "Can Demirel and Melih Berk Ek  \u0327sio  \u0306 glu",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a \r\nhttps://www.siemens.com/cert/advisories",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-01794",
  "openTime": "2018-01-25",
  "patchDescription": "SIEMENS\u697c\u5b87\u81ea\u63a7\u7cfb\u7edfDesigo PX\u53ef\u7f16\u7a0b\u81ea\u52a8\u5316\u7ad9\u63d0\u4f9b\u7075\u6d3b\u7684\u89e3\u51b3\u65b9\u6848\uff0c\u80fd\u591f\u53d1\u51fa\u62a5\u8b66\u4fe1\u53f7\u3001\u57fa\u4e8e\u65f6\u95f4\u7684\u65e5\u5fd7\u8bb0\u5f55\u7a0b\u5e8f\u548c\u8d8b\u52bf\uff0c\u53ef\u968f\u65f6\u4fee\u6539\u6216\u6269\u5c55\u3002 \r\n\r\nSiemens DESIGO PX\u56fa\u4ef6\u5b58\u5728\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff0c\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u4e0a\u4f20\u6076\u610f\u56fa\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens DESIGO PX\u56fa\u4ef6\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens Desigo Automation Controllers Compact PXC12/22/36-E.D \u003c6.00.204",
      "Siemens Desigo Automation Controllers Modular PXC00/50/100/200-E.D \u003c6.00.204",
      "Siemens Desigo Automation Controllers PXC00/64/128-U with Web module \u003c6.00.204",
      "Siemens Desigo Operator Unit PXM20-E \u003c6.00.204"
    ]
  },
  "referenceLink": "https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-824231.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2018-01-25",
  "title": "Siemens DESIGO PX\u56fa\u4ef6\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.