TI-2018-08179 Aliases CVE-2018-11454 GHSA-9qvc-rfh7-2xv6

Incorrect default permissions in Siemens SIMATIC STEP 7 and WinCC V10, V11, V12, SIMATIC…

LOW 38CWE-276Published 2018-08-07 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 (All versions < V13 SP2 Update 2), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 (All versions < V14 SP1 Update 6), SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 (All versions < V15 Update 2). Improper file permissions in the default installation of TIA Portal may allow an attacker with local file system access to manipulate resources which may be transferred to devices and executed there by a different user. No special privileges are required, but the victim needs to transfer the manipulated files to a device. Execution is caused on the target device rather than on the PG device.

Why it matters now

EPSS 0.00443 38th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15	SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 : All versions; SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 : All versions < V13 SP2 Update 2; SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 : All versions < V14 SP1 Update 6; SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 : All versions < V15 Update 2	—	No fix listed	CNA

SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14, SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 VendorSiemens Affected SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 : All versions; SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V13 : All versions < V13 SP2 Update 2; SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V14 : All versions < V14 SP1 Update 6; SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V15 : All versions < V15 Update 2 Fixed in — No fix listed CNA

CPE configurations NVD · 13

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):10.0:::::::*	10.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):11.0:::::::*	11.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):12.0:::::::*	12.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):13.0:::::::*	13.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):13.0:sp1::::::	13.0 sp1	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):14.0:::::::*	14.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):15.0:::::::*	15.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):10.0:::::::*	10.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):11.0:::::::*	11.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):12.0:::::::*	12.0	Vulnerable	Siemens

cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):13.0:sp1:*:*:*:*:*:* Versions 13.0 sp1 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_step_7_\(tia_portal\):15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Siemens

Show 3 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):13.0:::::::*	13.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):14.0:::::::*	14.0	Vulnerable	Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):15.0:::::::*	15.0	Vulnerable	Siemens

cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Siemens
cpe:2.3:a:siemens:simatic_wincc_\(tia_portal\):15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-11454
2026-10-03 Alias added: GHSA-9qvc-rfh7-2xv6

References

Advisory 1

https://cert-portal.siemens.com/productcert/pdf/ssa-979106.pdf

TI-2021-15234 Improper authentication in Siemens SIMATIC S7-1200 CPU family CVSS 3.1HIGH 7.5
TI-2018-08178 Incorrect default permissions in Siemens SIMATIC STEP 7 and WinCC V10, V11, V12, SIMATIC… CVSS 3.0HIGH 7.8
TI-2017-04602 Improper input validation in Siemens Primary Setup Tool CVSS 3.0MEDIUM 6.5
TI-2016-06162 A vulnerability has been identified in Primary Setup Tool (PST) (All versions < V4.2… CVSS 3.0MEDIUM 6.4
TI-2018-10022 Information disclosure in Siemens SIMATIC STEP 7 CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences