Critical severity · published Oct 17, 2018
CVE-2018-17895
LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution
9.8
CVSS
4.8%
EPSS
No
On KEV
Description
LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Laquis Scada · Lcds
through 4.1.0.3870 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-17895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-17895
Product
http://laquisscada.com/instale1.php
Third Party Advisory
http://www.securityfocus.com/bid/105719
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-289-01
More from Laquis Scada
9.8
CVE-2018-18998
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges
9.8
CVE-2018-18996
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the…
9.8
CVE-2018-17897
LAquis SCADA Versions 4.1.0.3870 and prior has several integer overflow to buffer overflow vulnerabilities, which may allow remote code execution
9.8
CVE-2018-17893
LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution
8.8
CVE-2018-18992
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server