PT-2019-2098 · Siemens+1 · Scalance+1

Published 2019-05-10 · Updated 2023-02-02 · CVE-2018-7082

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Aruba Instant versions prior to 4.2.4.12 Aruba Instant versions prior to 6.5.4.11 Aruba Instant versions prior to 8.3.0.6 Aruba Instant versions prior to 8.4.0.0 SCALANCE (affected versions not specified)

Description A command injection issue allows an authenticated administrative user to execute arbitrary commands on the underlying operating system. This could enable a malicious administrator to install backdoors or alter system configuration without being logged. The issue is related to insufficient neutralization of special elements in the case of the SCALANCE programmable logic controller.

Recommendations For Aruba Instant versions prior to 4.2.4.12, update to version 4.2.4.12 or later. For Aruba Instant versions prior to 6.5.4.11, update to version 6.5.4.11 or later. For Aruba Instant versions prior to 8.3.0.6, update to version 8.3.0.6 or later. For Aruba Instant versions prior to 8.4.0.0, update to version 8.4.0.0 or later. At the moment, there is no information about a newer version that contains a fix for SCALANCE.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2019-01853

CVE-2018-7082

Affected Products

Aruba Instant

Scalance

References · 6

• https://bdu.fstec.ru/vul/2019-01853 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-7082 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7082 · Vendor Advisory
• https://arubanetworks.com/assets/alert/ARUBA-PSA-2019-001.txt · Vendor Advisory
• http://securityfocus.com/bid/108374 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-549547.pdf · Note