CVE-2018-8840 A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event relate...
CriticalCVSS 9.8
EPSS 8.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| indusoft web studio | <= 8.1 | No fix listed |
| industrial-software intouch machine edition 2017 | <= 8.1 | No fix listed |
| ICS-CERT Schneider Electric InduSoft Web Studio and InTouch Machine Edition | = InduSoft Web Studio v8.1 and prior versions, and InTouch Machine Edition 2017 v8.1 and prior versions. | No fix listed |
References
- software.schneider-electric.com third-party-advisory
- 103949 third-party-advisory vdb-entry
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- www.tenable.com third-party-advisory