CVE-2019-18283CWE-502

CVE-2019-18283: vulnerability in Siemens SPPA-T3000 Application Server

Published · Updated

Follow this CVE+ Monitor SPPA-T3000 Application Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 5.4%
In short

The SPPA-T3000 Application Server allows anyone with network access to send malicious data to an unprotected service, which can execute arbitrary code on the server. This is dangerous because attackers can take full control of the system.

Technical detail

CWE-502 (Deserialization of Untrusted Data) vulnerability in AdminService of SPPA-T3000 versions prior to R8.2 SP2. The service accepts unauthenticated remote objects and deserializes them without validation, enabling remote code execution. Exploitation requires network access to the Application Highway.

Summary generated and translated by AI from the official description.
A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authentication on the Application Server. An attacker can gain remote code execution by sending specifically crafted objects to one of its functions. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.
Affected products
Siemens · SPPA-T3000 Application Server
Related CVEs — Siemens SPPA-T3000 Application Server

In the same product, most dangerous first.

CVE-2019-18288—CVE-2019-18288EPSS 4.0%CVE-2019-18316—CVE-2019-18316EPSS 2.7%CVE-2019-18315—CVE-2019-18315EPSS 2.5%CVE-2018-4832—CVE-2018-4832EPSS 2.4%CVE-2019-18314—CVE-2019-18314EPSS 2.3%CVE-2019-18284—CVE-2019-18284EPSS 2.0%