Search
Find a vulnerability
Search criteria
3 vulnerabilities found for M2M ETHERNET by ABB
VAR-201901-0481
Vulnerability from variot - Updated: 2024-11-23 21:52The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism. M2M ETHERNET Product (FW and ETH-FW) Contains an authentication vulnerability.Information may be tampered with. ABB M2M ETHERNET is a network analysis device of Swiss ABB company.
ABB M2M ETHERNET FW 2.22 and earlier versions and ETH-FW 1.01 and earlier versions have authorization issue vulnerabilities. Attackers can use this vulnerability to upload malicious language files. An attacker can exploit this issue to bypass the authentication mechanism. Successful exploits may aid in launching further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201901-0481",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "eth-fw",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "1.01"
},
{
"model": "fw",
"scope": "lte",
"trust": 1.0,
"vendor": "abb",
"version": "2.22"
},
{
"model": "eth-fw",
"scope": "lte",
"trust": 0.8,
"vendor": "abb",
"version": "2.22"
},
{
"model": "fw",
"scope": "lte",
"trust": 0.8,
"vendor": "abb",
"version": "1.01"
},
{
"model": "m2m ethernet",
"scope": "lte",
"trust": 0.6,
"vendor": "abb",
"version": "\u003c=1.01"
},
{
"model": "m2m ethernet",
"scope": "lte",
"trust": 0.6,
"vendor": "abb",
"version": "\u003c=2.22"
},
{
"model": "m2m ethernet",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "2.22"
},
{
"model": "m2m ethernet",
"scope": "eq",
"trust": 0.3,
"vendor": "abb",
"version": "1.01"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "BID",
"id": "106243"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:abb:eth-fw_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:abb:fw_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Maxim Rupp (RuppIT)",
"sources": [
{
"db": "BID",
"id": "106243"
}
],
"trust": 0.3
},
"cve": "CVE-2018-17926",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "CVE-2018-17926",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "CNVD-2020-28495",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"id": "VHN-128434",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.8,
"id": "CVE-2018-17926",
"impactScore": 1.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-17926",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2018-17926",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2020-28495",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201812-784",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-128434",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "VULHUB",
"id": "VHN-128434"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
},
{
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism. M2M ETHERNET Product (FW and ETH-FW) Contains an authentication vulnerability.Information may be tampered with. ABB M2M ETHERNET is a network analysis device of Swiss ABB company. \n\r\n\r\nABB M2M ETHERNET FW 2.22 and earlier versions and ETH-FW 1.01 and earlier versions have authorization issue vulnerabilities. Attackers can use this vulnerability to upload malicious language files. \nAn attacker can exploit this issue to bypass the authentication mechanism. Successful exploits may aid in launching further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-17926"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "BID",
"id": "106243"
},
{
"db": "VULHUB",
"id": "VHN-128434"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "ICS CERT",
"id": "ICSA-18-352-07",
"trust": 3.4
},
{
"db": "NVD",
"id": "CVE-2018-17926",
"trust": 3.4
},
{
"db": "BID",
"id": "106243",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-28495",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201812-784",
"trust": 0.7
},
{
"db": "SEEBUG",
"id": "SSVID-98835",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-128434",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "VULHUB",
"id": "VHN-128434"
},
{
"db": "BID",
"id": "106243"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
},
{
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"id": "VAR-201901-0481",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "VULHUB",
"id": "VHN-128434"
}
],
"trust": 1.45
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
}
]
},
"last_update_date": "2024-11-23T21:52:36.078000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://new.abb.com/"
},
{
"title": "Patch for ABB M2M ETHERNET Improper Authentication Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/217739"
},
{
"title": "ABB M2M ETHERNET Remediation measures for authorization problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87982"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128434"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-352-07"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/106243"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17926"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17926"
},
{
"trust": 0.3,
"url": "http://www.abb.com/"
},
{
"trust": 0.3,
"url": "https://new.abb.com/products/2csg299903r4052/m2m-ethernet-network-analyser"
},
{
"trust": 0.3,
"url": "http://search.abb.com/library/download.aspx?documentid=abbvu-epbp-r-5672\u0026languagecode=en\u0026documentpartid=2csg299903r4052\u0026action=launch"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "VULHUB",
"id": "VHN-128434"
},
{
"db": "BID",
"id": "106243"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
},
{
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"db": "VULHUB",
"id": "VHN-128434"
},
{
"db": "BID",
"id": "106243"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
},
{
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-05-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"date": "2019-01-31T00:00:00",
"db": "VULHUB",
"id": "VHN-128434"
},
{
"date": "2018-12-18T00:00:00",
"db": "BID",
"id": "106243"
},
{
"date": "2019-03-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"date": "2018-12-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-784"
},
{
"date": "2019-01-31T17:29:00.677000",
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-05-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-28495"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-128434"
},
{
"date": "2018-12-18T00:00:00",
"db": "BID",
"id": "106243"
},
{
"date": "2019-03-28T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-014578"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-784"
},
{
"date": "2024-11-21T03:55:13.393000",
"db": "NVD",
"id": "CVE-2018-17926"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "M2M ETHERNET Product Authentication vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-014578"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-784"
}
],
"trust": 0.6
}
}
CVE-2018-17926 (GCVE-0-2018-17926)
Vulnerability from nvd – Published: 2019-01-31 17:00 – Updated: 2024-09-16 22:09
VLAI
EPSS
VEX
Summary
The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism.
Severity
No CVSS data available.
CWE
- CWE-287 - Improper Authentication CWE-287
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/106243 | vdb-entryx_refsource_BID |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ABB | M2M ETHERNET |
Affected:
FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior.
|
Date Public
2018-12-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:01:14.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "106243",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106243"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "M2M ETHERNET",
"vendor": "ABB",
"versions": [
{
"status": "affected",
"version": "FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior."
}
]
}
],
"datePublic": "2018-12-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication CWE-287",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-01T10:57:01.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"name": "106243",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106243"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2018-12-18T00:00:00",
"ID": "CVE-2018-17926",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "M2M ETHERNET",
"version": {
"version_data": [
{
"version_value": "FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior."
}
]
}
}
]
},
"vendor_name": "ABB"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Authentication CWE-287"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "106243",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106243"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2018-17926",
"datePublished": "2019-01-31T17:00:00.000Z",
"dateReserved": "2018-10-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:09:25.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17926 (GCVE-0-2018-17926)
Vulnerability from cvelistv5 – Published: 2019-01-31 17:00 – Updated: 2024-09-16 22:09
VLAI
EPSS
VEX
Summary
The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism.
Severity
No CVSS data available.
CWE
- CWE-287 - Improper Authentication CWE-287
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/106243 | vdb-entryx_refsource_BID |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ABB | M2M ETHERNET |
Affected:
FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior.
|
Date Public
2018-12-18 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:01:14.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "106243",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106243"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "M2M ETHERNET",
"vendor": "ABB",
"versions": [
{
"status": "affected",
"version": "FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior."
}
]
}
],
"datePublic": "2018-12-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "Improper Authentication CWE-287",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-01T10:57:01.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"name": "106243",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/106243"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2018-12-18T00:00:00",
"ID": "CVE-2018-17926",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "M2M ETHERNET",
"version": {
"version_data": [
{
"version_value": "FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior."
}
]
}
}
]
},
"vendor_name": "ABB"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by bypassing the user authentication mechanism."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Authentication CWE-287"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "106243",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106243"
},
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-352-07"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2018-17926",
"datePublished": "2019-01-31T17:00:00.000Z",
"dateReserved": "2018-10-02T00:00:00.000Z",
"dateUpdated": "2024-09-16T22:09:25.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}