CVE-2018-3658
Medium
Description
Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with Intel AMT provisioned to potentially cause a partial denial of service via network access.
SeverityMedium
CVSS5.3
Exploit probability—
ProductSiemens Simatic Field Pg M5 Firmware
PublishedSep 12, 2018
First seenSep 12, 2018
How to fix
Update
- siemens simatic_field_pg_m5_firmware22.01.06 or later
- siemens simatic_ipc427e_firmware21.01.09 or later
- siemens simatic_ipc477e_firmware21.01.09 or later
- siemens simatic_ipc547e_firmwarer1.30.0 or later
- siemens simatic_pc547g_firmwarer1.23.0 or later
- siemens simatic_ipc627d_firmware19.02.11 or later
- siemens simatic_ipc647d_firmware19.01.14 or later
- siemens simatic_ipc677d_firmware19.02.11 or later
- siemens simatic_ipc827d_firmware19.02.11 or later
- siemens simatic_ipc847d_firmware19.01.14 or later
- siemens simatic_itp1000_firmware23.01.04 or later
- intel converged_security_management_engine_firmware12.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens simatic_field_pg_m5_firmware | v < 22.01.06 | 22.01.06 |
| siemens simatic_ipc427e_firmware | v < 21.01.09 | 21.01.09 |
| siemens simatic_ipc477e_firmware | v < 21.01.09 | 21.01.09 |
| siemens simatic_ipc547e_firmware | v < r1.30.0 | r1.30.0 |
| siemens simatic_pc547g_firmware | v < r1.23.0 | r1.23.0 |
| siemens simatic_ipc627d_firmware | v < 19.02.11 | 19.02.11 |
| siemens simatic_ipc647d_firmware | v < 19.01.14 | 19.01.14 |
| siemens simatic_ipc677d_firmware | v < 19.02.11 | 19.02.11 |
| siemens simatic_ipc827d_firmware | v < 19.02.11 | 19.02.11 |
| siemens simatic_ipc847d_firmware | v < 19.01.14 | 19.01.14 |
| siemens simatic_itp1000_firmware | v < 23.01.04 | 23.01.04 |
| intel converged_security_management_engine_firmware | 11.0.0 ≤ v < 12.0.5 | 12.0.5 |
| intel active_management_technology_firmware | v < 12.0.5 | 12.0.5 |
| intel manageability_engine_firmware | 9.0.0.0 ≤ v < 11.0 | 11.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.