vulnwire
8.8high

CVE-2018-12980in critical feed1 exploit

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
29.8%
percentile 98%
Public exploits
1
Exploit-DB

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02. The vulnerability allows an authenticated user to upload arbitrary files to the file system with the permissions of the web server.

Exploit prediction (EPSS)

29.80% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-45014 WAGO e!DISPLAY 7300T - Multiple Vulnerabilities · webapps · 2018-07-13

CVSS scores

Assigned byVersionScoreVector
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

  • cert.vde.com /en-us/advisories/vde-2018-010 · x_refsource_MISC, x_transferred
  • sec-consult.com /en/blog/advisories/remote-code-execution-via-multiple-attack-vectors-in-wago-edisplay/ · x_refsource_MISC, x_transferred
  • ics-cert.us-cert.gov /advisories/ICSA-18-198-02 · x_refsource_MISC, x_transferred
  • wago.com /medias/SA-WBM-2018-004.pdf?context=bWFzdGVyfHJvb3R8MjgyNzYwfGFwcGxpY2F0aW9uL3BkZnxoMWUvaD · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/45014/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • seclists.org /fulldisclosure/2018/Jul/38 · mailing-list, x_refsource_FULLDISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.