CVEvulnerability
CVE-2018-13802
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-10-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-264, CWE-269
Description
A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the SSH interface in on port 22/tcp. The attacker must be authenticated to exploit the vulnerability. The vulnerability could allow an attacker to execute arbitrary code on the device.
Affected configurations
• siemens rox ii firmware (< 2.12.1)
Related
Weakness · not in database (1)
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- http://www.securityfocus.com/bid/105545 Third Party Advisory, VDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-493830.pdf Vendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-18-282-03 Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/105545 Third Party Advisory, VDB Entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-493830.pdf Vendor Advisory
- https://ics-cert.us-cert.gov/advisories/ICSA-18-282-03 Third Party Advisory, US Government Resource