PT-2018-14282 · Apache Friends+1 · Xampp Client+1

Dan Regalado · Published 2018-10-30 · Updated 2019-10-09 · CVE-2018-17933

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VGo Robot versions 3.0.3.52164 through 3.0.3.53662 VGo Robot versions prior to 3.0.3.52164

Description The issue allows user accounts to execute commands outside their privileges, potentially within the scope of an admin account. If an attacker has access to VGo XAMPP Client credentials, they may be able to execute admin commands on the connected robot.

Recommendations For VGo Robot versions 3.0.3.52164 through 3.0.3.53662, update to a version that includes a fix for this issue. For VGo Robot versions prior to 3.0.3.52164, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to admin commands on the connected robot until a patch is available. Restrict access to VGo XAMPP Client credentials to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2018-17933

Affected Products

Vgo Robot

Xampp Client

References · 3

• https://osv.dev/vulnerability/CVE-2018-17933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17933 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-114-01 · Note