Low severity · published Feb 1, 2019
CVE-2018-19004
LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration
3.3
CVSS
3.7%
EPSS
No
On KEV
Description
LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
LCDS Laquis SCADA · ICS-CERT
All versions prior to version 4.1.0.4150 · source: vendor
LS
Laquis Scada · Lcds
before 4.1.0.4150 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19004
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19004
Third Party Advisory
http://www.securityfocus.com/bid/106634
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01
More from LCDS Laquis SCADA
9.8
CVE-2018-18996
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the…
9.8
CVE-2018-18998
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges
8.8
CVE-2018-18992
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server
8.8
CVE-2018-18988
LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file
5.3
CVE-2018-18990
LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation