Security readout for executives and security teams
Plain-English summary
CVE-2018-4861 affects Siemens SCALANCE M875 devices. An attacker who already has administrative authentication and network access to the HTTPS web interface could read and download arbitrary files from the device filesystem. This is mainly a management-plane exposure risk, not evidence of unauthenticated compromise.
Executive priority
Address this where SCALANCE M875 manages sensitive industrial connectivity or is reachable beyond tightly controlled admin networks. The attacker needs admin access, lowering broad internet risk, but arbitrary file access on network infrastructure can expose configuration or operational data.
Technical view
The issue is a CWE-22 path traversal/file access weakness in SCALANCE M875 all versions. The source bundle states exploitation requires remote access to the web interface on 443/tcp and administrative authentication. No CVSS details or fixed versions are provided in the bundle.
Likely exposure
Exposure is likely limited to environments running Siemens SCALANCE M875 with the web interface reachable to an attacker and valid administrative credentials available or compromised. The bundle says all versions are affected, but does not provide deployment prevalence.
Exploitation context
The Siemens advisory text in the bundle stated no public exploitation was known at publication. The CVE is not listed as KEV in the bundle. There is no source evidence here of active exploitation.
Researcher notes
Evidence is limited to the CVE record and Siemens advisory reference. The bundle does not include CVSS, proof-of-concept details, fixed versions, or named mitigations beyond the access prerequisites. Avoid assuming exploit availability or patch status without consulting Siemens SSA-977428.
Mitigation direction
- Review Siemens SSA-977428 for current remediation guidance and fixed-version information.
- Restrict 443/tcp web interface access to trusted management networks only.
- Harden and rotate administrative credentials for exposed SCALANCE M875 devices.
- Monitor device logs for unexpected file downloads where logging supports it.
Validation and detection
- Inventory Siemens SCALANCE M875 devices and treat all versions as affected.
- Confirm whether the HTTPS web interface is reachable from untrusted networks.
- Review administrative accounts and recent privileged access to affected devices.
- Check Siemens SSA-977428 for device-specific remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-4861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://cert-portal.siemens.com/productcert/pdf/ssa-977428.pdfCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.