SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-477628937] Siemens Viewport for Web Office Portal

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2017-06-29OtherSiemensHannes Trunde from Kapsch BusinessCom AG reported this vulnerability to Siemens. N/ACVE-2017-6869 N/AN/AN/A

Source

						
							
								
#
# Siemens Viewport for Web Office Portal
#


### VULNERABLE VENDOR
Siemens


### VULNERABLE PRODUCT
Viewport for Web Office Portal



### RESEARCHER
Hannes Trunde from Kapsch BusinessCom AG reported this vulnerability to Siemens.



### AFFECTED PRODUCTS

Siemens reports that the vulnerability affects the following ViewPort for Web Office Portal products:

ViewPort for Web Office Portal: versions prior to revision number 1453



### IMPACT

Successful exploitation of this vulnerability could allow a remote attacker to upload and execute arbitrary code.



### VULNERABILITY OVERVIEW

IMPROPER AUTHENTICATION CWE-287
An unauthenticated remote attacker may be able to use specially crafted network packets to upload arbitrary code to Port 443/TCP or Port 80/TCP and execute with the permissions of the operating system user.
CVE-2017-6869 has been assigned to this vulnerability.
A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)





### BACKGROUND

Critical Infrastructure Sector(s): Energy
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany




### MITIGATION

Siemens has released software revision number 1453 for ViewPort for Web Office Portal to address the vulnerability. It is recommended that users update to the fixed version. This new version can be obtained by emailing Siemens Energy Customer Support Center at: support.energy@siemens.com


Siemens recommends the following mitigations until patches can be applied:

Protect access to Port 443/TCP and Port 80/TCP of the affected product with appropriate measures.

Disable Port 80/TCP and use TLS client certificates (PKI) to access Port 443/TCP.

Apply Defense-in-Depth.

https://www.siemens.com/gridsecurity


For more information on this vulnerability and more detailed mitigation instructions, please see Siemens Security Advisory SSA-545214 at the following location:

http://www.siemens.com/cert/advisories