PT-2018-2656 · Beckhoff · Twincat

Mr_Me + 1 · Publicado 2018-03-13 · Atualizado 2018-05-23 · CVE-2018-7502

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TwinCAT versions 2.11 R3 2259 through 3.1 Build 4022.4

Description The issue is related to insufficient validation of user-supplied input in kernel drivers, which could allow an attacker to exploit this and potentially gain SYSTEM privileges. This could lead to privilege escalation.

Recommendations For TwinCAT versions 2.11 R3 2259 through 3.1 Build 4022.4, consider restricting access to the kernel drivers until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Untrusted Pointer Dereference

Enumeração de Fraquezas

CWE-20

CWE-822

Identificadores relacionados

BDU:2019-01278

CVE-2018-7502

Produtos afetados

Twincat

Referências · 8

• https://osv.dev/vulnerability/CVE-2018-7502 · Aviso do Fabricante
• https://vuldb.com/?id.114964 · Nota
• http://securityfocus.com/bid/103487 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7502 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-01278 · Nota de Segurança
• https://srcincite.io/advisories/src-2018-0007 · Nota
• https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdf · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02 · Nota