PT-2018-10744 · Abb · Abb Microscada

Fritz Sands · Published 2017-08-18 · Updated 2023-05-16 · CVE-2018-1168

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ABB MicroSCADA versions 9.3 with FP 1-2-3

Description This issue allows local attackers to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this issue to escalate privileges to SYSTEM.

Recommendations For ABB MicroSCADA versions 9.3 with FP 1-2-3, consider restricting access to the critical files that are left open to manipulation by any authenticated user until a patch is available. As a temporary workaround, limit the privileges of authenticated users to minimize the risk of exploitation.

Fix

Incorrect Permission

Improper Access Control

Weakness Enumeration

CWE-732

CWE-284

Related Identifiers

BDU:2025-12644

CVE-2018-1168

ZDI-18-141

Affected Products

Abb Microscada

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2018-1168 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-141 · Security Note
• https://bdu.fstec.ru/vul/2025-12644 · Security Note
• https://library.e.abb.com/public/7a88a74b12bb492ea138b1f2365d00f6/ABBVU-PGGA-33888_ABB_SoftwareVulnerabilityHandlingAdvisory_Rev_A.pdf?x-sign=MJfu9cHtRUUubpLAYzyWFTmW5W+mg3kZ/nm7F/Jw5HlFTQf4eNyfLAgE8HozRJEC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1168 · Vendor Advisory
• https://t.me/cvenotify/50613 · Telegram Post
• https://clouddefense.ai/cve/2018/CVE-2018-1168 · Note
• https://avd.aquasec.com/nvd/2018/cve-2018-1168 · Note
• https://t.me/cvenotify/48603 · Telegram Post