Sign-up

ID

VAR-201902-0647


CVE

CVE-2018-18988


TITLE

LAquis SCADA Input validation vulnerability

Trust: 0.8

sources: IVD: 7d851b30-463f-11e9-9851-000c29342cb1 // CNVD: CNVD-2019-02384

DESCRIPTION

LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash. LCDS Laquis SCADA Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the Memory.Double method. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the aq process. Script embedded in a crafted file can create files in arbitrary locations using the Ini.WriteString method. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition

Trust: 10.53

sources: NVD: CVE-2018-18988 // JVNDB: JVNDB-2018-014334 // ZDI: ZDI-19-072 // ZDI: ZDI-19-083 // ZDI: ZDI-19-088 // ZDI: ZDI-19-086 // ZDI: ZDI-19-076 // ZDI: ZDI-19-093 // ZDI: ZDI-19-073 // ZDI: ZDI-19-078 // ZDI: ZDI-19-096 // ZDI: ZDI-19-075 // ZDI: ZDI-19-089 // ZDI: ZDI-19-079 // ZDI: ZDI-19-070 // CNVD: CNVD-2019-02384 // IVD: 7d851b30-463f-11e9-9851-000c29342cb1

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 7d851b30-463f-11e9-9851-000c29342cb1 // CNVD: CNVD-2019-02384

AFFECTED PRODUCTS

vendor:laquis scadamodel:softwarescope: - version: -

Trust: 9.1

vendor:lcdsmodel:laquis scadascope:ltversion:4.1.0.4150

Trust: 1.8

vendor:lcdsmodel:le\303\243o consultoria e desenvolvimento de sistemas ltda me laquis scadascope:eqversion:-4.1.0.3870

Trust: 0.6

vendor:laquis scadamodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 7d851b30-463f-11e9-9851-000c29342cb1 // ZDI: ZDI-19-072 // ZDI: ZDI-19-070 // ZDI: ZDI-19-079 // ZDI: ZDI-19-089 // ZDI: ZDI-19-075 // ZDI: ZDI-19-096 // ZDI: ZDI-19-078 // ZDI: ZDI-19-073 // ZDI: ZDI-19-093 // ZDI: ZDI-19-076 // ZDI: ZDI-19-086 // ZDI: ZDI-19-088 // ZDI: ZDI-19-083 // CNVD: CNVD-2019-02384 // JVNDB: JVNDB-2018-014334 // NVD: CVE-2018-18988

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2018-18988
value: MEDIUM

Trust: 4.9

ZDI: CVE-2018-18988
value: HIGH

Trust: 4.2

nvd@nist.gov: CVE-2018-18988
value: HIGH

Trust: 1.0

NVD: CVE-2018-18988
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-02384
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201901-510
value: HIGH

Trust: 0.6

IVD: 7d851b30-463f-11e9-9851-000c29342cb1
value: HIGH

Trust: 0.2

ZDI: CVE-2018-18988
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 4.9

ZDI: CVE-2018-18988
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 4.2

nvd@nist.gov: CVE-2018-18988
severity: HIGH
baseScore: 8.3
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 8.5
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-02384
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7d851b30-463f-11e9-9851-000c29342cb1
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2018-18988
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: IVD: 7d851b30-463f-11e9-9851-000c29342cb1 // ZDI: ZDI-19-072 // ZDI: ZDI-19-070 // ZDI: ZDI-19-079 // ZDI: ZDI-19-089 // ZDI: ZDI-19-075 // ZDI: ZDI-19-096 // ZDI: ZDI-19-078 // ZDI: ZDI-19-073 // ZDI: ZDI-19-093 // ZDI: ZDI-19-076 // ZDI: ZDI-19-086 // ZDI: ZDI-19-088 // ZDI: ZDI-19-083 // CNVD: CNVD-2019-02384 // JVNDB: JVNDB-2018-014334 // CNNVD: CNNVD-201901-510 // NVD: CVE-2018-18988

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.8

problemtype:CWE-125

Trust: 1.0

sources: JVNDB: JVNDB-2018-014334 // NVD: CVE-2018-18988

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201901-510

TYPE

Input validation error

Trust: 0.8

sources: IVD: 7d851b30-463f-11e9-9851-000c29342cb1 // CNNVD: CNNVD-201901-510

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-014334

PATCH
title:LAquis SCADA has issued an update to correct this vulnerability.url:https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01
Trust: 9.1
title:TopPageurl:https://laquisscada.com/
Trust: 0.8
title:LAquis SCADA Input Validation Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/150979
Trust: 0.6
title:LAquis SCADA Enter the fix for the verification vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88655
Trust: 0.6
sources:
            
            
            ZDI: ZDI-19-072 // 
            
            
            
            ZDI: ZDI-19-070 // 
            
            
            
            ZDI: ZDI-19-079 // 
            
            
            
            ZDI: ZDI-19-089 // 
            
            
            
            ZDI: ZDI-19-075 // 
            
            
            
            ZDI: ZDI-19-096 // 
            
            
            
            ZDI: ZDI-19-078 // 
            
            
            
            ZDI: ZDI-19-073 // 
            
            
            
            ZDI: ZDI-19-093 // 
            
            
            
            ZDI: ZDI-19-076 // 
            
            
            
            ZDI: ZDI-19-086 // 
            
            
            
            ZDI: ZDI-19-088 // 
            
            
            
            ZDI: ZDI-19-083 // 
            
            
            
            CNVD: CNVD-2019-02384 // 
            
            
            
            JVNDB: JVNDB-2018-014334 // 
            
            
            
            CNNVD: CNNVD-201901-510

EXTERNAL IDS
db:NVDid:CVE-2018-18988
Trust: 12.3
db:ICS CERTid:ICSA-19-015-01
Trust: 3.0
db:BIDid:106634
Trust: 1.6
db:CNVDid:CNVD-2019-02384
Trust: 0.8
db:CNNVDid:CNNVD-201901-510
Trust: 0.8
db:JVNDBid:JVNDB-2018-014334
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-6568
Trust: 0.7
db:ZDIid:ZDI-19-072
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6579
Trust: 0.7
db:ZDIid:ZDI-19-070
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6575
Trust: 0.7
db:ZDIid:ZDI-19-079
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6626
Trust: 0.7
db:ZDIid:ZDI-19-089
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6571
Trust: 0.7
db:ZDIid:ZDI-19-075
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6681
Trust: 0.7
db:ZDIid:ZDI-19-096
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6574
Trust: 0.7
db:ZDIid:ZDI-19-078
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6569
Trust: 0.7
db:ZDIid:ZDI-19-073
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6678
Trust: 0.7
db:ZDIid:ZDI-19-093
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6572
Trust: 0.7
db:ZDIid:ZDI-19-076
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6623
Trust: 0.7
db:ZDIid:ZDI-19-086
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6625
Trust: 0.7
db:ZDIid:ZDI-19-088
Trust: 0.7
db:ZDI_CANid:ZDI-CAN-6620
Trust: 0.7
db:ZDIid:ZDI-19-083
Trust: 0.7
db:IVDid:7D851B30-463F-11E9-9851-000C29342CB1
Trust: 0.2
sources:
            
            
            IVD: 7d851b30-463f-11e9-9851-000c29342cb1 // 
            
            
            
            ZDI: ZDI-19-072 // 
            
            
            
            ZDI: ZDI-19-070 // 
            
            
            
            ZDI: ZDI-19-079 // 
            
            
            
            ZDI: ZDI-19-089 // 
            
            
            
            ZDI: ZDI-19-075 // 
            
            
            
            ZDI: ZDI-19-096 // 
            
            
            
            ZDI: ZDI-19-078 // 
            
            
            
            ZDI: ZDI-19-073 // 
            
            
            
            ZDI: ZDI-19-093 // 
            
            
            
            ZDI: ZDI-19-076 // 
            
            
            
            ZDI: ZDI-19-086 // 
            
            
            
            ZDI: ZDI-19-088 // 
            
            
            
            ZDI: ZDI-19-083 // 
            
            
            
            CNVD: CNVD-2019-02384 // 
            
            
            
            JVNDB: JVNDB-2018-014334 // 
            
            
            
            CNNVD: CNNVD-201901-510 // 
            
            
            
            NVD: CVE-2018-18988

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-19-015-01
Trust: 12.1
url:http://www.securityfocus.com/bid/106634
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18988
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-18988
Trust: 0.8
sources:
            
            
            ZDI: ZDI-19-072 // 
            
            
            
            ZDI: ZDI-19-070 // 
            
            
            
            ZDI: ZDI-19-079 // 
            
            
            
            ZDI: ZDI-19-089 // 
            
            
            
            ZDI: ZDI-19-075 // 
            
            
            
            ZDI: ZDI-19-096 // 
            
            
            
            ZDI: ZDI-19-078 // 
            
            
            
            ZDI: ZDI-19-073 // 
            
            
            
            ZDI: ZDI-19-093 // 
            
            
            
            ZDI: ZDI-19-076 // 
            
            
            
            ZDI: ZDI-19-086 // 
            
            
            
            ZDI: ZDI-19-088 // 
            
            
            
            ZDI: ZDI-19-083 // 
            
            
            
            CNVD: CNVD-2019-02384 // 
            
            
            
            JVNDB: JVNDB-2018-014334 // 
            
            
            
            CNNVD: CNNVD-201901-510 // 
            
            
            
            NVD: CVE-2018-18988

CREDITS
Esteban Ruiz (mr_me) of Source Incite
Trust: 9.1
sources:
            
            
            ZDI: ZDI-19-072 // 
            
            
            
            ZDI: ZDI-19-070 // 
            
            
            
            ZDI: ZDI-19-079 // 
            
            
            
            ZDI: ZDI-19-089 // 
            
            
            
            ZDI: ZDI-19-075 // 
            
            
            
            ZDI: ZDI-19-096 // 
            
            
            
            ZDI: ZDI-19-078 // 
            
            
            
            ZDI: ZDI-19-073 // 
            
            
            
            ZDI: ZDI-19-093 // 
            
            
            
            ZDI: ZDI-19-076 // 
            
            
            
            ZDI: ZDI-19-086 // 
            
            
            
            ZDI: ZDI-19-088 // 
            
            
            
            ZDI: ZDI-19-083

SOURCES
db:IVDid:7d851b30-463f-11e9-9851-000c29342cb1
db:ZDIid:ZDI-19-072
db:ZDIid:ZDI-19-070
db:ZDIid:ZDI-19-079
db:ZDIid:ZDI-19-089
db:ZDIid:ZDI-19-075
db:ZDIid:ZDI-19-096
db:ZDIid:ZDI-19-078
db:ZDIid:ZDI-19-073
db:ZDIid:ZDI-19-093
db:ZDIid:ZDI-19-076
db:ZDIid:ZDI-19-086
db:ZDIid:ZDI-19-088
db:ZDIid:ZDI-19-083
db:CNVDid:CNVD-2019-02384
db:JVNDBid:JVNDB-2018-014334
db:CNNVDid:CNNVD-201901-510
db:NVDid:CVE-2018-18988

LAST UPDATE DATE
2025-02-01T22:42:43.135000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-19-072date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-070date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-079date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-089date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-075date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-096date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-078date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-073date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-093date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-076date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-086date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-088date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-083date:2019-01-19T00:00:00
db:CNVDid:CNVD-2019-02384date:2019-01-22T00:00:00
db:JVNDBid:JVNDB-2018-014334date:2019-03-18T00:00:00
db:CNNVDid:CNNVD-201901-510date:2019-10-17T00:00:00
db:NVDid:CVE-2018-18988date:2024-11-21T03:56:59.620

SOURCES RELEASE DATE
db:IVDid:7d851b30-463f-11e9-9851-000c29342cb1date:2019-01-22T00:00:00
db:ZDIid:ZDI-19-072date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-070date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-079date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-089date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-075date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-096date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-078date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-073date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-093date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-076date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-086date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-088date:2019-01-19T00:00:00
db:ZDIid:ZDI-19-083date:2019-01-19T00:00:00
db:CNVDid:CNVD-2019-02384date:2019-01-22T00:00:00
db:JVNDBid:JVNDB-2018-014334date:2019-03-18T00:00:00
db:CNNVDid:CNNVD-201901-510date:2019-01-16T00:00:00
db:NVDid:CVE-2018-18988date:2019-02-01T17:29:00.187