PT-2018-1194 · Schneider Electric · Mge Sts+2
Ilya Karpov
·
Published
2018-03-15
·
Updated
2019-10-03
·
CVE-2018-7245
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS (affected versions not specified)
Description
An improper authorization issue exists in the integrated web server of the affected devices, allowing a remote attacker to change critical settings, such as UPS control and shutdown parameters, without authorization. The vulnerability can be exploited through the web server, which listens on Port 80/443/TCP. This could enable an attacker to modify device settings, including power and shutdown parameters.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authorization
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mge Network Management Card Transverse
Mge Sts
Mge Ups