CVE-2018-11691

{"id": "CVE-2018-11691", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-05-14T16:29:01.360", "references": [{"url": "http://www.emerson.com/documents/automation/deltav-smart-switches-en-179014.pdf", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/109110", "source": "cve@mitre.org"}, {"url": "https://www.us-cert.gov/ics/advisories/icsa-19-190-01", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches\u2019 management password upon commissioning. Emerson released patches for DeltaV workstations to address this issue, and the patches can be downloaded from Emerson\u2019s Guardian Support Portal. Please refer to the DeltaV Security Notification DSN19003 (KBA NK-1900-0808) for more information about this issue. DeltaV versions 13.3 and higher use the Network Device Command Center application to manage DeltaV Smart Switches, and this newer application is not impacted by this issue. After patching the Smart Switch Command Center, users are required to either commission the DeltaV Smart Switches or change password using the tool."}, {"lang": "es", "value": "La aplicaci\u00f3n Emerson DeltaV Smart Switch Command Center, disponible en las versiones 11.3.xy 12.3.1, no pudo cambiar la contrase\u00f1a de administraci\u00f3n de DeltaV Smart Switches al momento de la puesta en servicio. Emerson lanz\u00f3 parches para las estaciones de trabajo DeltaV para abordar este problema, y los parches se pueden descargar desde el Portal de Soporte Guardian de Emerson. Consulte la Notificaci\u00f3n de seguridad DeltaV DSN19003 (KBA NK-1900-0808) para obtener m\u00e1s informaci\u00f3n sobre este problema. Las versiones 13.3 y posteriores de DeltaV usan la aplicaci\u00f3n Centro de comando de dispositivos de red para administrar los conmutadores inteligentes DeltaV, y esta nueva aplicaci\u00f3n no se ve afectada por este problema. Despu\u00e9s de reparar el Smart Switch Command Center, los usuarios deben comisionar los DeltaV Smart Switches o cambiar la contrase\u00f1a con la herramienta."}], "lastModified": "2020-02-10T21:43:04.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:emerson:ve6046_firmware:09.0.12:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CCF066D-BAE6-4E29-8079-27BA1798F32A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:emerson:ve6046:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "03F17F44-79D5-4463-AD37-29013D540AA0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}