CVE-2018-4850: siemens ag simatic s7-400 (incl. f) cpu hardware version 4.0 and below, simatic s7-400 (incl. f) cpu hardware version 5.0, simatic s7-400h cpu hardware version 4.5 and below Improper Input Validation

Vulnerability summary

CVE-2018-4850 is a high (CVSS 7.5) Improper Input Validation vulnerability in siemens ag simatic s7-400 (incl. f) cpu hardware version 4.0 and below, simatic s7-400 (incl. f) cpu hardware version 5.0, simatic s7-400h cpu hardware version 4.5 and below. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 83.9% of scored vulnerabilities.

Timeline

1. 16-05-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SIMATIC S7-400 (incl. F) CPU hardware version 4.0 and below (All versions), SIMATIC S7-400 (incl. F) CPU hardware version 5.0 (All firmware versions < V5.2), SIMATIC S7-400H CPU hardware version 4.5 and below (All versions). The affected CPUs improperly validate S7 communication packets which could cause a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.