CVEvulnerability
CVE-2018-18995
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-01-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-306
Description
Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing configuration settings such as IP addresses.
Affected configurations
• abb gate-e1 firmware
• abb gate-e2 firmware
Related
Weakness · CWE (1)
- CWE-306 Missing Authentication for Critical Functionality weakness
References
- http://www.securityfocus.com/bid/106247 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01 Mitigation, Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/106247 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01 Mitigation, Third Party Advisory, US Government Resource