CVE-2018-12980

Опубликовано: 12 июл. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server.

Ссылки

http://seclists.org/fulldisclosure/2018/Jul/38
Exploit
Mailing List
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2018-010
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45014/
Exploit
Third Party Advisory
VDB Entry
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/
Exploit
Third Party Advisory
https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/38
Exploit
Mailing List
Third Party Advisory
https://cert.vde.com/en-us/advisories/vde-2018-010
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-198-02
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45014/
Exploit
Third Party Advisory
VDB Entry
https://www.sec-consult.com/en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/
Exploit
Third Party Advisory
https://www.wago.com/medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaDg4LzkzNjE3NTIxOTUxMDIucGRmfDU1NmJkYjEzNDY0ZGU4OWQ1OTMyMjUwNTlmZTI0MzgwNDQ1MDY1YzU3OWRmZDk1NzYzODAwMDI3ODg1NDJlZjU
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:wago:762-3000_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3000:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:wago:762-3001_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3001:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:wago:762-3002_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3002:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:wago:762-3003_firmware:*:*:*:*:*:*:*:*

Версия до 02 (исключая)

cpe:2.3:h:wago:762-3003:-:*:*:*:*:*:*:*

EPSS

Процентиль: 95%

0.20487

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-26jc-rvr3-77x3

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 95%

0.20487

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434