PT-2018-1293 · Schneider Electric · Mge Sts+2

Ilya Karpov + 2 · Published 2018-03-15 · Updated 2019-10-03 · CVE-2018-7243

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS (affected versions not specified)

Description An authorization bypass issue exists in the integrated web server of the affected devices, allowing a remote attacker to gain full access to the device by bypassing the authorization system. The vulnerability is related to insufficient access control in the web server, which could enable a remote attacker to bypass authentication and obtain full control over the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2018-00789

CVE-2018-7243

Affected Products

Mge Network Management Card Transverse

Mge Sts

Mge Ups

References · 4

• https://schneider-electric.com/en/download/document/SEVD-2018-074-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00789 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-7243 · Security Note
• https://securitylab.ru/news/492768.php · Note