VULNERABILITY INTELLIGENCE

CVE-2018-8872

CVSS score8.1 HIGH

EPSS probability2.20%

CISA KEVNot currently listed

Published2018-05-04

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory.

Weakness classification

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Primary references

ics-cert@hq.dhs.gov — Third Party Advisory, VDB Entry
ics-cert@hq.dhs.gov — Third Party Advisory, US Government Resource
ics-cert@hq.dhs.gov — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory