CVE-2018-19616

Published: Dic 26, 2018 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2018-11303 Aliases: GSD-2018-19616

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,1

Source: [email protected]

Attack Vector: network

Attack Complexity: high

Privileges Required: none

User Interaction: none

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

MEDIUM 6,8

Source: [email protected]

Access Vector: network

Access Complexity: medium

Authentication: none

Confidentiality: partial

Integrity: partial

Availability: partial

Description

AI Translation Available

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,0324

Percentile

0,9th

Updated

EPSS Score Trend (Last 90 Days)

287

Improper Authentication

Draft

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Confidentiality Availability Access Control

Potential Impacts:

Read Application Data Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands

Applicable Platforms

Technologies: ICS/OT, Not Technology-Specific, Web Based

Likelihood of Exploit: High

View CWE Details

Exploit

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access …

Authentication Bypass / Credentials Bypass (AB/CB)

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass

Author: Luca.Chiou Published:

View Exploit Code →

Operating System

Powermonitor 1000 Firmware by Rockwellautomation

Product Information

Vendor Rockwellautomation

Product Powermonitor 1000 Firmware

Version 1408-em3a-ent_b

CPE Identifier

View Detailed Analysis


                  cpe:2.3:o:rockwellautomation:powermonitor_1000_firmware:1408-em3a-ent_b:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

http://packetstormsecurity.com/files/150619/Rockwell-Automa…