Lucene search

IcscertCVE-2018-8840

HistoryApr 18, 2018 - 8:29 p.m.

CVE-2018-8840

2018-04-1820:29:00

CWE-119

CWE-121

icscert

web.nvd.nist.gov

cve-2018-8840

remote attacker

packet

indusoft web studio

intouch machine edition

code execution

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.116

Percentile

95.3%

JSON

A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.

Affected configurations

Nvd

Node

indusoftweb_studioRange≤8.1

Node

industrial-softwareintouch_machine_edition_2017Range≤8.1

VendorProductVersionCPE
indusoftweb_studio*cpe:2.3:a:indusoft:web_studio:*:*:*:*:*:*:*:*
industrial-softwareintouch_machine_edition_2017*cpe:2.3:a:industrial-software:intouch_machine_edition_2017:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
indusoft	web_studio	*	cpe:2.3:a:indusoft:web_studio::::::::
industrial-software	intouch_machine_edition_2017	*	cpe:2.3:a:industrial-software:intouch_machine_edition_2017::::::::

CNA Affected

[
  {
    "product": "Schneider Electric InduSoft Web Studio and InTouch Machine Edition",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "InduSoft Web Studio v8.1 and prior versions, and InTouch Machine Edition 2017 v8.1 and prior versions."
      }
    ]
  }
]

References

software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/

www.securityfocus.com/bid/103949

ics-cert.us-cert.gov/advisories/ICSA-18-107-01

www.tenable.com/security/research/tra-2018-07

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.116

Percentile

95.3%

JSON

Related for CVE-2018-8840