Multiple vulnerabilities in Schneider Electric Triconex Tricon
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2018-8872 CVE-2018-7522 |
| CWE-ID | CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Triconex Tricon 3008 Hardware solutions / Security hardware applicances |
| Vendor | Schneider Electric |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Buffer overflow
EUVDB-ID: #VU11920
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-8872
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when the system call reads directly from memory addresses within the control program area without any verification. A remote unauthenticated attacker can trigger memory corruption, copy any data within memory.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate to the latest version.
Vulnerable software versionsTriconex Tricon 3008: 10.0 - 10.4
External linkshttp://ics-cert.us-cert.gov/advisories/ICSA-18-107-02
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Buffer overflow
EUVDB-ID: #VU11930
Risk: Low
CVSSv3.1: 6.9 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-7522
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to registers are stored to a fixed memory location when a system call is made. A local attacker can trigger memory corruption, modify the data in this location and gain supervisor-level access and control system states.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate to the latest version.
Vulnerable software versionsTriconex Tricon 3008: 10.0 - 10.4
External linkshttp://ics-cert.us-cert.gov/advisories/ICSA-18-107-02
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
