PT-2019-1483 · Schneider Electric · Somachine Basic+1

Publicado 2019-02-14 · Atualizado 2022-01-31 · CVE-2018-7822

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions SoMachine Basic versions prior to V1.10.0.0 Modicon M221 versions prior to V1.10.0.0

Description The issue is related to incorrect default permissions, which could allow an attacker to gain access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic. This is due to improper default settings of access rights.

Recommendations For SoMachine Basic versions prior to V1.10.0.0, update to firmware V1.10.0.0 or later to resolve the issue. For Modicon M221 versions prior to V1.10.0.0, update to firmware V1.10.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the system hosting SoMachine Basic to minimize the risk of exploitation.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

BDU:2019-00891

CVE-2018-7822

Produtos afetados

Modicon M221

Somachine Basic

Referências · 7

• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-045-01-SoMachineBasic+M221.pdf&p_Doc_Ref=SEVD-2019-045-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7822 · Nota de Segurança
• https://schneider-electric.com/en/download/document/SEVD-2019-045-01 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00891 · Nota de Segurança
• https://t.me/cvenotify/19909 · Publicação no Telegram
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-045-01-SoMachineBasic+M221.pdf&p_Doc_Ref=SEVD-2019-045-01 · Nota
• https://osv.dev/vulnerability/CVE-2018-7822 · Aviso do Fabricante