CVE-2018-7502
Severity Score
7.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges.
Los controladores del kernel en Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259 y TwinCAT 3.1 no validan correctamente los valores de puntero proporcionados por el usuario. Un atacante que pueda ejecutar código en el objetivo podría explotar esta vulnerabilidad para obtener privilegios SYSTEM.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-02-26 CVE Reserved
- 2018-03-23 CVE Published
- 2024-09-16 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-822: Untrusted Pointer Dereference
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/103487 | Third Party Advisory | |
| https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02 | Mitigation | |
| https://srcincite.io/advisories/src-2018-0007 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Beckhoff Search vendor "Beckhoff" | Twincat Search vendor "Beckhoff" for product "Twincat" | 2.11 Search vendor "Beckhoff" for product "Twincat" and version "2.11" | - |
Affected
| ||||||
| Beckhoff Search vendor "Beckhoff" | Twincat Search vendor "Beckhoff" for product "Twincat" | 3.1 Search vendor "Beckhoff" for product "Twincat" and version "3.1" | - |
Affected
| ||||||
| Beckhoff Search vendor "Beckhoff" | Twincat C\+\+ Search vendor "Beckhoff" for product "Twincat C\+\+" | 3.1 Search vendor "Beckhoff" for product "Twincat C\+\+" and version "3.1" | - |
Affected
| ||||||