CVE:CVE-2018-13812
CNNVD:CNNVD-201811-482
Siemens SIMATIC HMI Comfort Panels等都是德国西门子（Siemens）公司的用于操控和监控机器和设备的HMI软件。
多款Siemens产品中存在路径遍历漏洞。攻击者可利用该漏洞从设备上下载任意文件。以下产品和版本受到影响：Siemens SIMATIC HMI Comfort Panels 4”-22” 15 Update 4之前版本；SIMATIC HMI Comfort Outdoor Panels 7” & 15” 15 Update 4之前版本；SIMATIC HMI KTP Mobile Panels（KTP400F、KTP700、KTP700F、KTP900和KTP900F）15 Update 4之前版本；SIMATIC WinCC Runtime Advanced 15 Update 4之前版本；SIMATIC WinCC Runtime Professional 15 Update 4之前版本；SIMATIC WinCC (TIA Portal) 15 Update 4之前版本；SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel)。
solution:Upgrade siemens simatic_hmi_comfort_panels_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_comfort_outdoor_panels_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_ktp_mobile_panels_ktp400f_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_ktp_mobile_panels_ktp700_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_ktp_mobile_panels_ktp700f_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_ktp_mobile_panels_ktp900_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_ktp_mobile_panels_ktp900f_firmware to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_wincc_(tia_portal) to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_wincc_runtime to a higher version than 15.0,and avoid the version (,15.0]; Upgrade siemens simatic_hmi_tp_firmware to a higher version than *; Upgrade siemens simatic_hmi_mp_firmware to a higher version than *; Upgrade siemens simatic_hmi_op_firmware to a higher version than *