Login Request a demo
High severity · published Feb 5, 2019
CVE-2018-18992
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server
8.8
CVSS
2%
EPSS
No
On KEV
Description
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
LCDS Laquis SCADA · ICS-CERT
All versions prior to version 4.1.0.4150 · source: vendor
LS
Laquis Scada · Lcds
before 4.1.0.4150 · source: NVD
Affected product
LL
LCDS Laquis SCADA
ICS-CERT
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-18992
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-18992
Third Party Advisory
http://www.securityfocus.com/bid/106634
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01
More from LCDS Laquis SCADA
9.8
CVE-2018-18996
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the…
9.8
CVE-2018-18998
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges
8.8
CVE-2018-18988
LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file
5.3
CVE-2018-18990
LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation
5.3
CVE-2018-19000
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data