CVE-2018-3991 is a critical heap overflow vulnerability in the WibuKey Network server management, version 6.40.2402.500, affecting various products including Siemens SIMATIC WinCC Open Architecture and WibuKey. An unauthenticated attacker can trigger this flaw by sending a specially crafted TCP packet, potentially leading to remote code execution with a CVSS score of 9.8 (CRITICAL). While there are no known public exploits in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion and media coverage, indicating high awareness. Despite its high EPSS and FAUCET Risk Score, it is not currently listed on CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.40.2402.500CPE matchmatch criteria | cpe:2.3:a:wibu:wibukey:6.40.2402.500:*:*:*:*:*:*:* | ||
3.14CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_wincc_open_architecture:3.14:*:*:*:*:*:*:* | ||
3.15CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_wincc_open_architecture:3.15:*:*:*:*:*:*:* | ||
3.16CPE matchmatch criteria | cpe:2.3:o:siemens:simatic_wincc_open_architecture:3.16:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.