Lucene search

[email protected]CVE-2018-8838

HistoryApr 17, 2018 - 9:29 p.m.

CVE-2018-8838

2018-04-1721:29:00

[email protected]

web.nvd.nist.gov

cve-2018-8838

access controls

centum cs

centum vp

exaopc

b/m9000

vulnerability

exploit

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier, Exaopc versions R3.75.00 and earlier, B/M9000 CS all versions, and B/M9000 VP versions R8.01.01 and earlier may allow a local attacker to exploit the message management function of the system. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

Affected configurations

NVD

Node

yokogawab\/m9000_csMatch-

yokogawab\/m9000_vpRange≤r8.01.01

yokogawacentum_cs_3000Range≤r3.09.50

yokogawacentum_cs_3000Range≤r3.09.50small

yokogawacentum_vpRange≤r6.03.10

yokogawacentum_vpRange≤r6.03.10basic

yokogawacentum_vpRange≤r6.03.10small

yokogawaexaopcRange≤r3.75.00

CPENameOperatorVersion
yokogawa:b\/m9000_csyokogawa b/m9000 cseq-
yokogawa:b\/m9000_vpyokogawa b/m9000 vpler8.01.01
yokogawa:centum_cs_3000yokogawa centum cs 3000ler3.09.50
yokogawa:centum_vpyokogawa centum vpler6.03.10
yokogawa:exaopcyokogawa exaopcler3.75.00

CPE	Name	Operator	Version
yokogawa:b\/m9000_cs	yokogawa b/m9000 cs	eq	-
yokogawa:b\/m9000_vp	yokogawa b/m9000 vp	le	r8.01.01
yokogawa:centum_cs_3000	yokogawa centum cs 3000	le	r3.09.50
yokogawa:centum_vp	yokogawa centum vp	le	r6.03.10
yokogawa:exaopc	yokogawa exaopc	le	r3.75.00

CNA Affected

[
  {
    "product": "Yokogawa CENTUM and Exaopc",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "CENTUM series CENTUM CS 1000 all versions CENTUM CS 3000 versions R3.09.50 and prior CENTUM CS 3000 Small versions R3.09.50 and prior CENTUM VP versions R6.03.10 and prior CENTUM VP Small versions R6.03.10 and prior CENTUM VP Basic versions R6.03.10 and prior Exaopc versions R3.75.00 and prior B/M9000 CS all versions and B/M9000 VP versions R8.01.01 and prior."
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSA-18-102-01

4.4 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

6.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

0.4%

JSON

Related for CVE-2018-8838

ics1 nvd1 prion1 nessus2 cvelist1