PT-2017-4345 · Schneider Electric · Triconex Tricon Mp 3008

Published 2017-12-13 · Updated 2019-10-09 · CVE-2018-8872

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Schneider Electric Triconex Tricon MP 3008 firmware versions 10.0 through 10.4

Description: The issue is related to a buffer overflow in memory, which could allow a remote attacker to gain unauthorized access to protected information. In the affected firmware versions, system calls read directly from memory addresses within the control program area without verification, potentially allowing an attacker to manipulate data and copy it anywhere within memory.

Recommendations: For firmware versions 10.0 through 10.4, consider restricting access to the control program area to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2024-07899

CVE-2018-8872

Affected Products

Triconex Tricon Mp 3008

References · 9

• https://schneider-electric.com/en/download/document/SEVD-2017-347-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8872 · Security Note
• https://bdu.fstec.ru/vul/2024-07899 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8872 · Vendor Advisory
• https://se.com/au/en/download/document/SEVD-2017-347-01 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-18-107-02 · Note
• http://securityfocus.com/bid/103947 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02 · Note
• https://vuldb.com/ru/?id.117383 · Note