CVE-2018-8872

Published: May 4, 2018Modified: Nov 21, 2024

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory.

Affected (1)

Products: Schneider Electric: Triconex Tricon Mp 3008 Firmware

Schneider Electric

1 product

Triconex Tricon Mp 3008 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Triconex Tricon Mp 3008 Firmware	From 10.0 to 10.4

Running on/with	Platform Versions
Schneider Electric Triconex Tricon Mp 3008	All versions

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (6)

http://www.securityfocus.com/bid/103947

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/

Source: ics-cert@hq.dhs.gov

Vendor Advisory

http://www.securityfocus.com/bid/103947

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.