PT-2017-4345 · Schneider Electric · Triconex Tricon Mp 3008

Publicado 2017-12-13 · Atualizado 2019-10-09 · CVE-2018-8872

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Schneider Electric Triconex Tricon MP 3008 firmware versions 10.0 through 10.4

Description: The issue is related to a buffer overflow in memory, which could allow a remote attacker to gain unauthorized access to protected information. In the affected firmware versions, system calls read directly from memory addresses within the control program area without verification, potentially allowing an attacker to manipulate data and copy it anywhere within memory.

Recommendations: For firmware versions 10.0 through 10.4, consider restricting access to the control program area to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2024-07899

CVE-2018-8872

Produtos afetados

Triconex Tricon Mp 3008

Referências · 9

• https://schneider-electric.com/en/download/document/SEVD-2017-347-01 · Aviso do Fabricante
• https://se.com/au/en/download/document/SEVD-2017-347-01 · Nota
• https://cisa.gov/news-events/ics-advisories/icsa-18-107-02 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8872 · Nota de Segurança
• http://securityfocus.com/bid/103947 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02 · Nota
• https://vuldb.com/ru/?id.117383 · Nota
• https://bdu.fstec.ru/vul/2024-07899 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-8872 · Aviso do Fabricante