CVE-2018-7824

An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files.

CVSS v3 4.9 MEDIUM
CVSS v2.0 6.8 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:C/A:N

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/	Patch Vendor Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*

Configuration 2 (hide)

AND

cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x86:*

Configuration 3 (hide)

cpe:2.3:a:schneider-electric:driver_suite:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:12

Type	Values Removed	Values Added
References	~~() https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/ - Patch, Vendor Advisory~~	() https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/ - Patch, Vendor Advisory

Information

Published : 2019-05-22 20:29

Updated : 2024-11-21 04:12

NVD link : CVE-2018-7824

Mitre link : CVE-2018-7824

CVE.ORG link : CVE-2018-7824

JSON object : View

Products Affected

schneider-electric

driver_suite
modbus_serial_driver

microsoft

windows

CWE

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

{"id": "CVE-2018-7824", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:N", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "published": "2019-05-22T20:29:01.150", "references": [{"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/", "tags": ["Patch", "Vendor Advisory"], "source": "cybersecurity@se.com"}, {"url": "https://www.schneider-electric.com/en/download/document/SEVD-2019-099-01/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-610"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-610"}]}], "descriptions": [{"lang": "en", "value": "An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files."}, {"lang": "es", "value": "Existe una vulnerabilidad de tipo referencias a recurso controlado externamente (CWE-610) en Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 y anterior, para Windows 32-bit OS:V2.17 IE 27 y anterior, y como parte del Driver Suite versi\u00f3n:V14.12 y anterior), que podr\u00eda permitir el acceso de escritura a los archivos del sistema disponibles solo para usuarios con privilegio SYSTEM u otros archivos de usuarios importantes."}], "lastModified": "2024-11-21T04:12:47.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7535403-6248-47E9-A381-65680E269E6B", "versionEndIncluding": "3.17"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*", "vulnerable": false, "matchCriteriaId": "82132539-3C34-4B63-BE2A-F51077D8BC5A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:modbus_serial_driver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "203AD4F6-98F6-421B-8037-547FD7882228", "versionEndIncluding": "2.17"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x86:*", "vulnerable": false, "matchCriteriaId": "60366048-32FE-4081-A852-04319FD7A52C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:driver_suite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FE70BFB-F058-4D31-9558-B96DC0B8EFAB", "versionEndIncluding": "14.12"}], "operator": "OR"}]}], "sourceIdentifier": "cybersecurity@se.com"}