CVE-2018-18995

Published: Jan 3, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing configuration settings such as IP addresses.

Affected (2)

Products: Abb: Gate E1 Firmware, Gate E2 Firmware

2 products

Gate E1 Firmware

Gate E2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Gate E1 Firmware	All versions

Running on/with	Platform Versions
Abb Gate E1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Abb Gate E2 Firmware	All versions

Running on/with	Platform Versions
Abb Gate E2	All versions

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (4)

http://www.securityfocus.com/bid/106247

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01

Source: ics-cert@hq.dhs.gov

MitigationThird Party AdvisoryUS Government Resource

http://www.securityfocus.com/bid/106247

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationThird Party AdvisoryUS Government Resource

Timeline

No history available yet.