CVEvulnerability

CVE-2018-4847

4.6 MEDIUM Published 2018-04-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
4.6 MEDIUM — CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-311, CWE-538

Description

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.

Affected configurations

• siemens simatic wincc oa operator

Related

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory weakness

References