Authentication Bypass in ABB PLC Gateway Ethernet Devices
CVE-2018-18995

9.8CRITICAL

Key Information:

Vendor

Abb

Status
Abb Gate-e1 And Gate-e2
Vendor
CVE Published:
3 January 2019

What is CVE-2018-18995?

ABB GATE-E1 and GATE-E2 Ethernet devices have a significant vulnerability wherein the administrative telnet and web interfaces lack a configurable authentication mechanism. This deficiency permits unauthorized users to interact with critical device functions. Potential exploitation can lead to device resets, unauthorized reading or modification of internal registers, and alterations to key configuration settings such as IP addresses, thereby compromising the integrity and security of the operational environment.

Affected Version(s)

ABB GATE-E1 and GATE-E2 All versions

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01
x_refsource_MISC
http://www.securityfocus.com/bid/106247
vdb-entryx_refsource_BID

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2018-18995 : Authentication Bypass in ABB PLC Gateway Ethernet Devices