CVE-2018-8840

A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.

Score

CVSS 3.0 9.8 Critical

Status

Modified - ics-cert@hq.dhs.gov

Published

2018-04-18

Last modified

2024-09-16

Weaknesses

CWE-119, CWE-121

Affected products

• Schneider Electric Indusoft Web Studio And Intouch Machine Edition (Ics-cert)
• Web Studio (Indusoft)
• Intouch Machine Edition 2017 (Industrial-software)

References

• http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/
• http://www.securityfocus.com/bid/103949
• https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01
• https://www.tenable.com/security/research/tra-2018-07