Lucene search

[email protected]CVE-2018-12087

HistoryOct 03, 2018 - 6:29 p.m.

CVE-2018-12087

2018-10-0318:29:00

CWE-295

[email protected]

web.nvd.nist.gov

cve-2018-12087

network security

opc foundation

ua client

certificate validation

password decryption

5.3 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

5.2 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

25.2%

JSON

Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network infrastructure to decrypt passwords.

CPENameOperatorVersion
opcfoundation:ua-.netstandardopcfoundation ua-.netstandardeq*
opcfoundation:ua-.net-legacyopcfoundation ua-.net-legacyeq*

CPE	Name	Operator	Version
opcfoundation:ua-.netstandard	opcfoundation ua-.netstandard	eq	*
opcfoundation:ua-.net-legacy	opcfoundation ua-.net-legacy	eq	*

References

opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2018-12087.pdf

5.3 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

5.2 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

25.2%

JSON

Related for CVE-2018-12087

osv2 github1 prion1 cvelist1