CVE-2018-1168 : This vulnerability allows local attackers to escalate privileges on vulnerable i

This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097.

Published 2018-02-21 14:29:01

Updated 2023-05-16 21:04:23

Source Zero Day Initiative

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2018-1168

Hitachienergy » Sys600 Firmware » Version: 9.0
cpe:2.3:o:hitachienergy:sys600_firmware:9.0:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Sys600 » Version: N/A
Hitachienergy » Sys600 Firmware » Version: 9.1
cpe:2.3:o:hitachienergy:sys600_firmware:9.1:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Sys600 » Version: N/A
Hitachienergy » Sys600 Firmware » Version: 9.1.5
cpe:2.3:o:hitachienergy:sys600_firmware:9.1.5:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Sys600 » Version: N/A
Hitachienergy » Sys600 Firmware » Version: 9.2
cpe:2.3:o:hitachienergy:sys600_firmware:9.2:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Sys600 » Version: N/A
Hitachienergy » Sys600 Firmware » Version: 9.4
cpe:2.3:o:hitachienergy:sys600_firmware:9.4:*:*:*:*:*:*:*
Matching versions
When used together with: Hitachienergy » Sys600 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-1168

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 21 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1168

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-1168

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Assigned by: zdi-disclosures@trendmicro.com (Secondary)
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-1168

https://library.e.abb.com/public/7a88a74b12bb492ea138b1f2365d00f6/ABBVU-PGGA-33888_ABB_SoftwareVulnerabilityHandlingAdvisory_Rev_A.pdf?x-sign=MJfu9cHtRUUubpLAYzyWFTmW5W+mg3kZ/nm7F/Jw5HlFTQf4eNyfLAgE8HozRJEC

Mitigation;Vendor Advisory
https://zerodayinitiative.com/advisories/ZDI-18-141

ZDI-18-141 | Zero Day Initiative
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2018-1168

Products affected by CVE-2018-1168

Exploit prediction scoring system (EPSS) score for CVE-2018-1168

CVSS scores for CVE-2018-1168

CWE ids for CVE-2018-1168

References for CVE-2018-1168