Unscored CVE-2018-8872 EUVD-2018-20480GHSA-ggm5-5h63-2mvr

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within th…

Published May 4, 2018 · Updated Sep 16, 2024 · Assigned by icscert

Vendor: Schneider Electric Product: Triconex Tricon Category: ICS / OT

Description

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory.

Affected products

Vendor	Product	Affected	Fixed
Schneider Electric	Triconex Tricon	MP model 3008 firmware versions 10.0-10.4	—

Advisories 1

ICSA-18-107-02 Schneider Electric Triconex Tricon CISA ICS & IT advisories · Dec 18, 2018

References

https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02
103947 vdb-entry