TI-2018-08183 Aliases CVE-2018-11458 GHSA-hhf8-mrfp-rjvv

Integer overflow in Siemens SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D…

MEDIUM 43CWE-190Published 2018-12-12 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to execute code with privileged permissions on the system by sending specially crafted network requests to port 5900/tcp. Please note that this vulnerability is only exploitable if port 5900/tcp is manually opened in the firewall configuration of network port X130. The security vulnerability could be exploited by an attacker with network access to the affected devices and port. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the VNC server. At the time of advisory publication no public exploitation of this security vulnerability was known.

Why it matters now

EPSS 0.04593 91st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8	SINUMERIK 828D V4.7 : All versions < V4.7 SP6 HF1; SINUMERIK 840D sl V4.7 : All versions < V4.7 SP6 HF5; SINUMERIK 840D sl V4.8 : All versions < V4.8 SP3	—	No fix listed	CNA

SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7, SINUMERIK 840D sl V4.8 VendorSiemens Affected SINUMERIK 828D V4.7 : All versions < V4.7 SP6 HF1; SINUMERIK 840D sl V4.7 : All versions < V4.7 SP6 HF5; SINUMERIK 840D sl V4.8 : All versions < V4.8 SP3 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:o:siemens:sinumerik_828d_v4.7_firmware::::::::	up to 4.7	Vulnerable	Siemens
cpe:2.3:h:siemens:sinumerik_828d_v4.7:-:::::::*	not specified by NVD	Running on	Siemens
cpe:2.3:o:siemens:sinumerik_840d_sl_v4.7_firmware::::::::	up to 4.7	Vulnerable	Siemens
cpe:2.3:h:siemens:sinumerik_840d_sl_v4.7:-:::::::*	not specified by NVD	Running on	Siemens
cpe:2.3:o:siemens:sinumerik_840d_sl_v4.8_firmware::::::::	up to 4.8	Vulnerable	Siemens
cpe:2.3:h:siemens:sinumerik_840d_sl_v4.8:-:::::::*	not specified by NVD	Running on	Siemens

cpe:2.3:o:siemens:sinumerik_828d_v4.7_firmware:*:*:*:*:*:*:*:* Versions up to 4.7 Vulnerable ·Siemens
cpe:2.3:h:siemens:sinumerik_828d_v4.7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
cpe:2.3:o:siemens:sinumerik_840d_sl_v4.7_firmware:*:*:*:*:*:*:*:* Versions up to 4.7 Vulnerable ·Siemens
cpe:2.3:h:siemens:sinumerik_840d_sl_v4.7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
cpe:2.3:o:siemens:sinumerik_840d_sl_v4.8_firmware:*:*:*:*:*:*:*:* Versions up to 4.8 Vulnerable ·Siemens
cpe:2.3:h:siemens:sinumerik_840d_sl_v4.8:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-11458
2026-10-03 Alias added: GHSA-hhf8-mrfp-rjvv

References

Advisory 1

https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf

TI-2018-08191 A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D… CVSS 3.0CRITICAL 9.8
TI-2018-08187 Access control flaw in Siemens SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D… CVSS 3.0CRITICAL 9.8
TI-2018-08182 Heap-based buffer overflow in Siemens SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.7… CVSS 3.0HIGH 8.1
TI-2018-08190 Out-of-bounds read in Siemens SINUMERIK 808D V4.7, SINUMERIK 808D V4.8, SINUMERIK 828D… CVSS 3.0HIGH 7.8
TI-2018-08188 Stack-based buffer overflow in Siemens SINUMERIK 808D V4.7, SINUMERIK 808D V4.8… CVSS 3.0HIGH 7.8
TI-2018-08185 Protection mechanism failure in Siemens SINUMERIK 808D V4.7, SINUMERIK 808D V4.8… CVSS 3.0HIGH 7.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences