PT-2018-10133 · Modbuspal · Modbuspal

Trent Gordon · Published 2018-05-11 · Updated 2018-06-13 · CVE-2018-10832

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ModbusPal version 1.6b

Description The issue allows for an XML External Entity (XXE) attack. This occurs because projects and automations are saved in XML-based files (.xmpp and .xmpa respectively), which are susceptible to XXE injection. By sending a specially crafted .xmpp or .xmpa file to a user, when opened or imported in ModbusPal, it can return the contents of any local files to a remote attacker.

Recommendations For ModbusPal version 1.6b, as a temporary workaround, consider avoiding the use of .xmpp and .xmpa files from untrusted sources until a patch is available. Restrict access to sensitive local files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-10832

Affected Products

Modbuspal

References · 4

• 🔥 http://packetstormsecurity.com/files/147573/ModbusPal-1.6b-XML-External-Entity-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/44607 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10832 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10832 · Vendor Advisory