Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-11458: SINUMERIK machines risk remote code execution via open VNC port

CVE-2018-11458 · published 7 years ago

Summary

The SINUMERIK 828D V4.7 and 840D sl V4.7/V4.8 controllers contain a built‑in VNC service that can be tricked into running malicious code if the VNC port (5900) is opened in the firewall. An attacker on the network could then take control of the machine without needing any credentials or user action. Close the VNC port in the firewall or apply the latest firmware updates that disable or secure this service.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
siemens	sinumerik_828d_v4.7_firmware	<= 4.7 `cpe:2.3:o:siemens:sinumerik_828d_v4.7_firmware::::::::`
siemens	sinumerik_840d_sl_v4.7_firmware	<= 4.7 `cpe:2.3:o:siemens:sinumerik_840d_sl_v4.7_firmware::::::::`
siemens	sinumerik_840d_sl_v4.8_firmware	<= 4.8 `cpe:2.3:o:siemens:sinumerik_840d_sl_v4.8_firmware::::::::`

Original advisory text

A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to execute code with privileged permissions on the system by sending specially crafted network requests to port 5900/tcp. Please note that this vulnerability is only exploitable if port 5900/tcp is manually opened in the firewall configuration of network port X130. The security vulnerability could be exploited by an attacker with network access to the affected devices and port. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the VNC server. At the time of advisory publication no public exploitation of this security vulnerability was known.

References

http://www.securityfocus.com/bid/106185 Third Party Advisory VDB Entry
https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

8.1 High

Exploitation

5% chance of attack within 30 days

Type

CWE-190Integer Overflow

Timeline

Published12 Dec 2018

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-11458 · NVD

Track software like this

Free during beta