CVE-2018-18996 Vulnerability Details

  /     /     /  

CVE-2018-18996 Metadata Quick Info

CVE Published: 05/02/2019 | CVE Updated: 16/09/2024 | CVE Year: 2018
Source: icscert | Vendor: ICS-CERT | Product: LCDS Laquis SCADA
Status : PUBLISHED

---

CVE-2018-18996 Description

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-74
CWE Name: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS IN OUTPUT USED BY A DOWNSTREAM COMPONENT ( INJECTION ) CWE-74
Source: ICS-CERT

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).