CVE-2019-18286: siemens sppa-t3000_application_server Improper Authentication
Vulnerability summary
CVE-2019-18286 is a medium (CVSS 5.3) Improper Authentication vulnerability in siemens sppa-t3000_application_server. EPSS estimates a 1.58% chance of exploitation in the next 30 days, higher than 75.1% of scored vulnerabilities.
Timeline
- 12-12-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The Application Server exposes directory listings and files containing sensitive information. This vulnerability is independent from CVE-2019-18287. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.58%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.58% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Siemens1 product
- sppa-t3000_application_serverAll versions < Service Pack R8.2 SP2 | < r8.2 | r8.2 | r8.2:sp1
1 vendor · 1 product
References
2 links- packetstormsecurity.com/files/155665/Siemens-Security-Advisory-SPPA-T3000-Code-Execution.htmlX Refsource MISCThird Party AdvisoryVDB Entry