CVE-2018-11462 is a remote privilege-escalation vulnerability (CWE-264) in Siemens SINUMERIK 808D, 828D, and 840D sl CNC controller firmware: by sending a specially crafted authentication request to the controller over the network, an unauthenticated attacker can escalate their session to an elevated user account, though not all the way to root, and both NVD and Siemens rate the flaw 9.8 (critical) on the CVSS v3.0 scale.
Vulnerability summary
9.8
Critical
3.8%
EPSS score (FIRST)
No
CISA KEV catalog
2018-12-12
Published
Vulnerability ID: CVE-2018-11462 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Siemens SINUMERIK 808D, 828D, and 840D sl CNC controller firmware | — | SINUMERIK 808D V4.7 and V4.8, all versions prior to V4.91; SINUMERIK 828D V4.7 prior to V4.7 SP6 HF1; SINUMERIK 840D sl V4.7 prior to V4.7 SP6 HF5; SINUMERIK 840D sl V4.8 prior to V4.8 SP3; fixed in those respective service pack/hotfix releases, per Siemens advisory SSA-170881 |
What does this mean for affected devices?
CVE-2018-11462 (CWE-264, permissions/privilege handling) affects the controller firmware of Siemens SINUMERIK CNC systems. NVD's description states: "By sending a specially crafted authentication request to the affected systems a remote attacker could escalate his privileges to an elevated user account but not to root" (NVD).
Siemens advisory SSA-170881, "Vulnerabilities in SINUMERIK Controllers," lists this CVE as affecting SINUMERIK 808D V4.7 and V4.8 (all versions before V4.91), SINUMERIK 828D V4.7 (before V4.7 SP6 HF1), and SINUMERIK 840D sl V4.7 and V4.8 (before V4.7 SP6 HF5 and V4.8 SP3 respectively). The advisory credits researchers Anton Kalinin, Danila Parnishchev, Dmitry Sklyar, Gleb Gritsai, Kirill Nesterov, Radu Motspan, and Sergey Sidorov of Kaspersky Lab, and recommends updating to the fixed service pack or hotfix release, plus workarounds such as restoring the default firewall block on ports 4842/tcp and 5900/tcp on network port X130, a cell-protection concept, and VPNs for inter-cell communication (Siemens SSA-170881).
Both NVD and Siemens score the flaw CVSS v3.0 9.8 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low attack complexity, no privileges or user interaction required (NVD).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.03759 (90th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
SINUMERIK CNC controllers automate shop-floor machine tools and serial-production lines. Operators running an affected firmware version should apply the Siemens-listed update and, until then, keep the controller's management network behind a firewall with the default port blocks in place rather than exposing it directly.
Evidence
- By sending a specially crafted authentication request to the affected systems a remote attacker could escalate his privileges to an elevated user account but not to root. — NVD
- Affects SINUMERIK 808D V4.7/V4.8 (< V4.91), 828D V4.7 (< V4.7 SP6 HF1), and 840D sl V4.7/V4.8 (< V4.7 SP6 HF5 / V4.8 SP3); reported via coordinated disclosure by Kaspersky Lab researchers; mitigations include blocking ports 4842/tcp and 5900/tcp. — Siemens Security Advisory SSA-170881
- CVSS v3.0 base score 9.8 (critical), vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scored identically by both Siemens and NVD. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.03759 (90th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
