PT-2019-9690 · Lcds · Lcds Laquis Scada

Esteban Ruiz + 1 · Publicado 2019-01-19 · Atualizado 2019-10-09 · CVE-2018-18992

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150

Description The issue allows an attacker to execute remote code on the server due to improper sanitation of user input. This can be achieved through command injection vulnerabilities in various components of the LAquis SCADA Web Server, including the relatorioindividual TAG, acompanhamentotela TAGALTERE, acompanhamentotela PAGINA, and relatorioindividual TITULO.

Recommendations For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or later to resolve the issue. As a temporary workaround, consider restricting access to the LAquis SCADA Web Server to minimize the risk of exploitation. Avoid using user input in the affected components until the issue is resolved.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2018-18992

ZDI-19-059

ZDI-19-061

ZDI-19-062

ZDI-19-063

Produtos afetados

Lcds Laquis Scada

Referências · 8

• https://osv.dev/vulnerability/CVE-2018-18992 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18992 · Nota de Segurança
• http://securityfocus.com/bid/106634 · Nota
• https://zerodayinitiative.com/advisories/ZDI-19-062 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01 · Nota
• https://zerodayinitiative.com/advisories/ZDI-19-063 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-059 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-061 · Nota de Segurança