PT-2018-1719 · Laquis · Laquis Scada

Published 2018-10-02 · Updated 2019-10-09 · CVE-2018-17893

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: LAquis SCADA versions 4.1.0.3870 and prior

Description: The issue is related to an untrusted pointer dereference vulnerability in the LQS file parsing functionality of the LAquis SCADA tool, which is used for data collection and process control in industrial automation. This vulnerability may allow remote code execution.

Recommendations: For LAquis SCADA versions 4.1.0.3870 and prior, consider disabling the LQS file parsing functionality as a temporary workaround until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Untrusted Pointer Dereference

Weakness Enumeration

CWE-476

CWE-822

Related Identifiers

BDU:2018-01312

CVE-2018-17893

ZDI-18-1246

Affected Products

Laquis Scada

References · 10

• https://osv.dev/vulnerability/CVE-2018-17893 · Vendor Advisory
• http://laquisscada.com/instale1.php · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-1246 · Security Note
• https://bdu.fstec.ru/vul/2018-01312 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-17893 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/151417 · Note
• http://securityfocus.com/bid/105719 · Note
• https://securitylab.ru/news/495976.php · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-289-01 · Note
• https://news.rambler.ru/other/41059051-uyazvimosti-v-scada-sisteme-lcds-stavyat-pod-ugrozu-bezopasnost-predpriyatiy/?updated · Note