VULNERABILITY INTELLIGENCE

CVE-2018-4847

CVSS score4.6 MEDIUM

EPSS probability0.26%

CISA KEVNot currently listed

Published2018-04-23

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.

Weakness classification

CWE-311: Missing Encryption of Sensitive Data
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Primary references

productcert@siemens.com — Third Party Advisory, VDB Entry
productcert@siemens.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory