CVE-2018-4847

A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session key for accessing server) in Siemens WinCC OA Operator iOS app could allow an attacker with physical access to the mobile device to read unencrypted data from the app's directory. Siemens provides mitigations to resolve the security issue.

• CWE-538
• CWE-311

• http://www.securityfocus.com/bid/103941Third Party Advisory, VDB Entry
• https://cert-portal.siemens.com/productcert/pdf/ssa-597741.pdfVendor Advisory
• http://www.securityfocus.com/bid/103941Third Party Advisory, VDB Entry
• https://cert-portal.siemens.com/productcert/pdf/ssa-597741.pdfVendor Advisory

Published

Apr 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-4841A vulnerability has been identified in TIM 1531 IRC (All ver…9.8
• CVE-2018-4842A vulnerability has been identified in SCALANCE X-200IRT swi…
• CVE-2018-4843A vulnerability has been identified in SIMATIC S7-400 CPU 4…6.5
• CVE-2018-4844A vulnerability has been identified in SIMATIC WinCC OA UI f…6.7
• CVE-2018-4845A vulnerability has been identified in RAPIDLab 1200 systems…8.8
• CVE-2018-4846A vulnerability has been identified in RAPIDLab 1200 systems…
• CVE-2018-4848A vulnerability has been identified in SCALANCE X-200 switch…
• CVE-2018-4849A vulnerability has been identified in Siveillance VMS Video…
• CVE-2018-4850A vulnerability has been identified in SIMATIC S7-400 (incl.…
• CVE-2018-4851A vulnerability has been identified in SICLOCK TC100 (All ve…
• CVE-2018-4852A vulnerability has been identified in SICLOCK TC100 (All ve…
• CVE-2018-4853A vulnerability has been identified in SICLOCK TC100 (All ve…