Risk | Low |
Patch available | NO |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2018-18997 CVE-2018-18995 |
CWE-ID | CWE-79 CWE-306 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
GATE-E2 Hardware solutions / Firmware GATE-E1 Hardware solutions / Firmware |
Vendor | ABB |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU16605
Risk: Low
CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-18997
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationABB will not be releasing updated firmware, as both GATE-E1 and GATE-E2 have reached end of life (EOL). ABB recommends implementing defense-in-depth principles to minimize the risk that vulnerabilities are exploited.
GATE-E2: All versions
GATE-E1: All versions
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU16606
Risk: Low
CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2018-18995
CWE-ID:
CWE-306 - Missing Authentication for Critical Function
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due the devices do not allow authentication to be configured on administrative telnet or web interfaces. A remote attacker can bypass authentication to conduct device resets, read or modify registers, and change configuration settings such as IP addresses.
MitigationABB will not be releasing updated firmware, as both GATE-E1 and GATE-E2 have reached end of life (EOL). ABB recommends implementing defense-in-depth principles to minimize the risk that vulnerabilities are exploited.
GATE-E2: All versions
GATE-E1: All versions
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.