CVE-2018-12979

Опубликовано: 12 июл. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 5.5

EPSS Низкий

Описание

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. Weak permissions allow an authenticated user to overwrite critical files by abusing the unrestricted file upload in the WBM.

Ссылки

http://seclists.org/fulldisclosure/2018/Jul/38
Exploit
Mailing List
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2018-010
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45014/
Exploit
Third Party Advisory
VDB Entry
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/
Exploit
Third Party Advisory
https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/38
Exploit
Mailing List
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2018-010
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45014/
Exploit
Third Party Advisory
VDB Entry
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/
Exploit
Third Party Advisory
https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:wago:762-3000_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3000:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:wago:762-3001_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3001:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:wago:762-3002_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3002:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:wago:762-3003_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3003:-:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04881

Низкий

6.5 Medium

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-732

Связанные уязвимости

GHSA-7373-xjj5-q36p

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 89%

0.04881

Низкий

6.5 Medium

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-732