High ICSA-19-015-01 11 CVEs

LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

Published Jan 15, 2019 · Updated Jan 15, 2019

Vendor: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Product: SCADA

Summary

Successful exploitation of these vulnerabilities could allow remote code execution, data exfiltration, or cause a system crash.

Vulnerabilities 11

Unscored —

CVE-2018-18986

LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cau…

LCDS LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-18988

LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report for…

ICS-CERT LCDS Laquis SCADA

Feb 1, 2019
Unscored —

CVE-2018-18990 EPSS 39%

LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation…

ICS-CERT LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-18992

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an…

ICS-CERT LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-18994

LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project fil…

LCDS Laquis LCDS Laquis SCADA

Mar 27, 2019
Unscored —

CVE-2018-18996

LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, w…

ICS-CERT LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-18998

LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized acc…

ICS-CERT LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-19000

LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to se…

ICS-CERT LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-19002

LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially cr…

LCDS LCDS Laquis SCADA

Feb 5, 2019
Unscored —

CVE-2018-19004

LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, …

ICS-CERT LCDS Laquis SCADA

Feb 1, 2019
Unscored —

CVE-2018-19029

LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a poi…

LCDS LCDS Laquis SCADA

Feb 5, 2019

Revision history

2019-01-15 #1
ICSA-19-015-01 LCDS - Leao Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

References

ICS Advisory ICSA-19-015-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-19-015-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-19-015-01