CVEvulnerability

CVE-2018-18996

9.8 CRITICAL Published 2019-02-05 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2019-02-05
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.0 ([email protected]): 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-74, CWE-862

Description

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server.

Affected configurations

• lcds laquis scada (< 4.1.0.4150)

Weakness · CWE (2)

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
CWE-862 Missing Authorization weakness

References

http://www.securityfocus.com/bid/106634 Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01 Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/106634 Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-015-01 Third Party Advisory, US Government Resource

CVE-2018-18996

Description

Affected configurations

Related

Weakness · CWE (2)

References