CVE-2018-8838 - CVE House
Back to Database
Status published Medium CVE-2018-8838

A weakness in access controls in CENTUM CS 1000 all...

Vulnerability Description

A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier, Exaopc versions R3.75.00 and earlier, B/M9000 CS all versions, and B/M9000 VP versions R8.01.01 and earlier may allow a local attacker to exploit the message management function of the system. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-8838

Credits & Attribution

No credits recorded in the NVD database.

References

More from ICS-CERT

View All →
CVE-2019-6565
Moxa IKS and EDS fails to properly validate user input,...
Medium 6.1
CVE-2019-6563
Moxa IKS and EDS generate a predictable cookie calculated with...
Critical 9.8
CVE-2019-6561
Cross-site request forgery has been identified in Moxa IKS and...
High 8.8
CVE-2019-6559
Moxa IKS and EDS allow remote authenticated users to cause...
Medium 6.5
CVE-2019-6557
Several buffer overflow vulnerabilities have been identified in Moxa IKS...
Critical 9.8

Affected Vendor

Affected Software

Yokogawa CENTUM and Exaopc
Vulnerable Versions:
CENTUM series CENTUM CS 1000 all versions CENTUM CS 3000 versions R3.09.50 and prior CENTUM CS 3000 Small versions R3.09.50 and prior CENTUM VP versions R6.03.10 and prior CENTUM VP Small versions R6.03.10 and prior CENTUM VP Basic versions R6.03.10 and prior Exaopc versions R3.75.00 and prior B/M9000 CS all versions and B/M9000 VP versions R8.01.01 and prior.

Timeline

Official Publish: April 17th, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.