Vulnerability Description
A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Indusoft | Web Studio | <= 8.1 |
| Industrial-Software | Intouch Machine Edition 2017 | <= 8.1 |
Related Weaknesses (CWE)
References
- http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/Third Party Advisory
- http://www.securityfocus.com/bid/103949Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01Third Party AdvisoryUS Government Resource
- https://www.tenable.com/security/research/tra-2018-07Third Party Advisory
- http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/Third Party Advisory
- http://www.securityfocus.com/bid/103949Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01Third Party AdvisoryUS Government Resource
- https://www.tenable.com/security/research/tra-2018-07Third Party Advisory
FAQ
What is CVE-2018-8840?
CVE-2018-8840 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event relate...
How severe is CVE-2018-8840?
CVE-2018-8840 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-8840?
Check the references section above for vendor advisories and patch information. Affected products include: Indusoft Web Studio, Industrial-Software Intouch Machine Edition 2017.