Vulnerability-Lookup

BDU:2018-01072 (CVE-2018-10730)

Vulnerability from fstec – Published: 2018-09-07 – Updated: 2021-03-23 – View on bdu.fstec.ru Exploit exists Fixed

Title

Уязвимость компонентов config_transfer.cgi и software_update.cgi микропрограммного обеспечения управляемых коммутаторов FL SWITCH Phoenix Contact, позволяющая нарушителю выполнить произвольные команды

Summary

Уязвимость компонентов config_transfer.cgi и software_update.cgi микропрограммного обеспечения управляемых коммутаторов FL SWITCH Phoenix Contact связана с отсутствием нейтрализации специальных элементов во входных данных команд ОС. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные команды

Severity

9.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:S/C:C/I:C/A:C

7.9 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Potential vulnerability

Exploitation

Injection

Incidents

Being clarified

Remediation

Software update

CWE

CWE-78 - Непринятие мер по нейтрализации специальных элементов, используемых в команде операционной системы (Внедрение в команду операционной системы)

Aliases

CVE-2018-10730, PT-2018-13, ICSA-18-137-02

References

4 references

URL
https://nvd.nist.gov/vuln/detail/CVE-2018-10730
https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02
https://cert.vde.com/en-us/advisories/vde-2018-007
https://www.ptsecurity.com/ru-ru/research/threatscape/pt-2018-13/

Impacted products

29 products from 1 vendor

Vendors

Phoenix Contact GmbH & Co. KG

Products

FL Switch 3005, FL Switch 3005T, FL Switch 3004T-FX, FL Switch 3004T-FX ST, FL Switch 3008, FL Switch 3008T, FL Switch 3006T-2FX, FL Switch 3006T-2FX ST, FL Switch 3012E-2SFX, FL Switch 3016E, FL Switch 3016, FL Switch 3016T, FL Switch 3006T-2FX SM, FL Switch 4008T-2SFP, FL Switch 4008T-2GT-3FX SM, FL Switch 4008T-2GT-4FX SM, FL Switch 4808E-16FX LC-4GC, FL Switch 4808E-16FX SM-4GC, FL Switch 4808E-16FX SM ST-4GC, FL Switch 4808E-16FX ST-4GC, FL Switch 4808E-16FX-4GC, FL Switch 4808E-16FX SM LC-4GC, FL Switch 4012T 2GT 2FX, FL Switch 4012T-2GT-2FX ST, FL Switch 4824E-4GC, FL Switch 4800E-24FX-4GC, FL Switch 4800E-24FX SM-4GC, FL Switch 3012E-2FX SM, FL Switch 4000T-8POE-2SFP-R

Versions

от 1.0 до 1.33 (FL Switch 3005), от 1.0 до 1.33 (FL Switch 3005T), от 1.0 до 1.33 (FL Switch 3004T-FX), от 1.0 до 1.33 (FL Switch 3004T-FX ST), от 1.0 до 1.33 (FL Switch 3008), от 1.0 до 1.33 (FL Switch 3008T), от 1.0 до 1.33 (FL Switch 3006T-2FX), от 1.0 до 1.33 (FL Switch 3006T-2FX ST), от 1.0 до 1.33 (FL Switch 3012E-2SFX), от 1.0 до 1.33 (FL Switch 3016E), от 1.0 до 1.33 (FL Switch 3016), от 1.0 до 1.33 (FL Switch 3016T), от 1.0 до 1.33 (FL Switch 3006T-2FX SM), от 1.0 до 1.33 (FL Switch 4008T-2SFP), от 1.0 до 1.33 (FL Switch 4008T-2GT-3FX SM), от 1.0 до 1.33 (FL Switch 4008T-2GT-4FX SM), от 1.0 до 1.33 (FL Switch 4808E-16FX LC-4GC), от 1.0 до 1.33 (FL Switch 4808E-16FX SM-4GC), от 1.0 до 1.33 (FL Switch 4808E-16FX SM ST-4GC), от 1.0 до 1.33 (FL Switch 4808E-16FX ST-4GC), от 1.0 до 1.33 (FL Switch 4808E-16FX-4GC), от 1.0 до 1.33 (FL Switch 4808E-16FX SM LC-4GC), от 1.0 до 1.33 (FL Switch 4012T 2GT 2FX), от 1.0 до 1.33 (FL Switch 4012T-2GT-2FX ST), от 1.0 до 1.33 (FL Switch 4824E-4GC), от 1.0 до 1.33 (FL Switch 4800E-24FX-4GC), от 1.0 до 1.33 (FL Switch 4800E-24FX SM-4GC), от 1.0 до 1.33 (FL Switch 3012E-2FX SM), от 1.0 до 1.33 (FL Switch 4000T-8POE-2SFP-R)

Product types

Network device, Средство АСУ ТП, Network appliance software, ПО программно-аппаратного средства АСУ ТП

Mitigations

Использование рекомендаций: FL SWITCH 3005 www.phoenixcontact.net/qr/2891030/firmware_update FL SWITCH 3005T www.phoenixcontact.net/qr/2891032/firmware_update FL SWITCH 3004T-FX www.phoenixcontact.net/qr/2891033/firmware_update FL SWITCH 3004T-FX ST www.phoenixcontact.net/qr/2891034/firmware_update FL SWITCH 3008 www.phoenixcontact.net/qr/2891031/firmware_update FL SWITCH 3008T www.phoenixcontact.net/qr/2891035/firmware_update FL SWITCH 3006T-2FX www.phoenixcontact.net/qr/2891036/firmware_update FL SWITCH 3006T-2FX ST www.phoenixcontact.net/qr/2891037/firmware_update FL SWITCH 3012E-2SFX www.phoenixcontact.net/qr/2891067/firmware_update FL SWITCH 3016E www.phoenixcontact.net/qr/2891066/firmware_update FL SWITCH 3016 www.phoenixcontact.net/qr/2891058/firmware_update FL SWITCH 3016T www.phoenixcontact.net/qr/2891059/firmware_update FL SWITCH 3006T-2FX SM www.phoenixcontact.net/qr/2891060/firmware_update FL SWITCH 4008T-2SFP www.phoenixcontact.net/qr/2891062/firmware_update FL SWITCH 4008T-2GT-4FX SM www.phoenixcontact.net/qr/2891061/firmware_update FL SWITCH 4008T-2GT-3FX SM www.phoenixcontact.net/qr/2891160/firmware_update FL SWITCH 4808E-16FX LC-4GC www.phoenixcontact.net/qr/2891073/firmware_update FL SWITCH 4808E-16FX SM-4GC www.phoenixcontact.net/qr/2891080/firmware_update FL SWITCH 4808E-16FX SM ST-4GC www.phoenixcontact.net/qr/2891086/firmware_update FL SWITCH 4808E-16FX ST-4GC www.phoenixcontact.net/qr/2891085/firmware_update FL SWITCH 4808E-16FX-4GC www.phoenixcontact.net/qr/2891079/firmware_update FL SWITCH 4808E-16FX SM LC-4GC www.phoenixcontact.net/qr/2891074/firmware_update FL SWITCH 4012T 2GT 2FX www.phoenixcontact.net/qr/2891063/firmware_update FL SWITCH 4012T-2GT-2FX ST www.phoenixcontact.net/qr/2891161/firmware_update FL SWITCH 4824E-4GC www.phoenixcontact.net/qr/2891072/firmware_update FL SWITCH 4800E-24FX-4GC www.phoenixcontact.net/qr/2891102/firmware_update FL SWITCH 4800E-24FX SM-4GC www.phoenixcontact.net/qr/2891104/firmware_update FL SWITCH 3012E-2FX www.phoenixcontact.net/qr/2891120/firmware_update FL SWITCH 3012E-2FX SM www.phoenixcontact.net/qr/2891119/firmware_update FL SWITCH 4000T-8POE-2SFP-R - для обновления ПО требуется обращение в службу поддержки клиентов

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Phoenix Contact GmbH \u0026 Co. KG",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3005), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3005T), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3004T-FX), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3004T-FX ST), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3008), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3008T), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3006T-2FX), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3006T-2FX ST), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3012E-2SFX), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3016E), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3016), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3016T), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3006T-2FX SM), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4008T-2SFP), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4008T-2GT-3FX SM), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4008T-2GT-4FX SM), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4808E-16FX LC-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4808E-16FX SM-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4808E-16FX SM ST-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4808E-16FX ST-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4808E-16FX-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4808E-16FX SM LC-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4012T 2GT 2FX), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4012T-2GT-2FX ST), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4824E-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4800E-24FX-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4800E-24FX SM-4GC), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 3012E-2FX SM), \u043e\u0442 1.0 \u0434\u043e 1.33 (FL Switch 4000T-8POE-2SFP-R)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nFL SWITCH 3005 www.phoenixcontact.net/qr/2891030/firmware_update \nFL SWITCH 3005T www.phoenixcontact.net/qr/2891032/firmware_update \nFL SWITCH 3004T-FX www.phoenixcontact.net/qr/2891033/firmware_update \nFL SWITCH 3004T-FX ST www.phoenixcontact.net/qr/2891034/firmware_update \nFL SWITCH 3008 www.phoenixcontact.net/qr/2891031/firmware_update \nFL SWITCH 3008T www.phoenixcontact.net/qr/2891035/firmware_update \nFL SWITCH 3006T-2FX www.phoenixcontact.net/qr/2891036/firmware_update \nFL SWITCH 3006T-2FX ST www.phoenixcontact.net/qr/2891037/firmware_update \nFL SWITCH 3012E-2SFX www.phoenixcontact.net/qr/2891067/firmware_update \nFL SWITCH 3016E www.phoenixcontact.net/qr/2891066/firmware_update \nFL SWITCH 3016 www.phoenixcontact.net/qr/2891058/firmware_update \nFL SWITCH 3016T www.phoenixcontact.net/qr/2891059/firmware_update \nFL SWITCH 3006T-2FX SM www.phoenixcontact.net/qr/2891060/firmware_update \nFL SWITCH 4008T-2SFP www.phoenixcontact.net/qr/2891062/firmware_update \nFL SWITCH 4008T-2GT-4FX SM www.phoenixcontact.net/qr/2891061/firmware_update \nFL SWITCH 4008T-2GT-3FX SM www.phoenixcontact.net/qr/2891160/firmware_update \nFL SWITCH 4808E-16FX LC-4GC www.phoenixcontact.net/qr/2891073/firmware_update \nFL SWITCH 4808E-16FX SM-4GC www.phoenixcontact.net/qr/2891080/firmware_update \nFL SWITCH 4808E-16FX SM ST-4GC www.phoenixcontact.net/qr/2891086/firmware_update \nFL SWITCH 4808E-16FX ST-4GC www.phoenixcontact.net/qr/2891085/firmware_update \nFL SWITCH 4808E-16FX-4GC www.phoenixcontact.net/qr/2891079/firmware_update \nFL SWITCH 4808E-16FX SM LC-4GC www.phoenixcontact.net/qr/2891074/firmware_update \nFL SWITCH 4012T 2GT 2FX www.phoenixcontact.net/qr/2891063/firmware_update \nFL SWITCH 4012T-2GT-2FX ST www.phoenixcontact.net/qr/2891161/firmware_update \nFL SWITCH 4824E-4GC www.phoenixcontact.net/qr/2891072/firmware_update \nFL SWITCH 4800E-24FX-4GC www.phoenixcontact.net/qr/2891102/firmware_update \nFL SWITCH 4800E-24FX SM-4GC www.phoenixcontact.net/qr/2891104/firmware_update \nFL SWITCH 3012E-2FX www.phoenixcontact.net/qr/2891120/firmware_update \nFL SWITCH 3012E-2FX SM www.phoenixcontact.net/qr/2891119/firmware_update \nFL SWITCH 4000T-8POE-2SFP-R - \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u041f\u041e \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0432 \u0441\u043b\u0443\u0436\u0431\u0443 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "22.02.2018",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "07.09.2018",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2018-01072",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2018-10730, PT-2018-13, ICSA-18-137-02",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FL Switch 3005, FL Switch 3005T, FL Switch 3004T-FX, FL Switch 3004T-FX ST, FL Switch 3008, FL Switch 3008T, FL Switch 3006T-2FX, FL Switch 3006T-2FX ST, FL Switch 3012E-2SFX, FL Switch 3016E, FL Switch 3016, FL Switch 3016T, FL Switch 3006T-2FX SM, FL Switch 4008T-2SFP, FL Switch 4008T-2GT-3FX SM, FL Switch 4008T-2GT-4FX SM, FL Switch 4808E-16FX LC-4GC, FL Switch 4808E-16FX SM-4GC, FL Switch 4808E-16FX SM ST-4GC, FL Switch 4808E-16FX ST-4GC, FL Switch 4808E-16FX-4GC, FL Switch 4808E-16FX SM LC-4GC, FL Switch 4012T 2GT 2FX, FL Switch 4012T-2GT-2FX ST, FL Switch 4824E-4GC, FL Switch 4800E-24FX-4GC, FL Switch 4800E-24FX SM-4GC, FL Switch 3012E-2FX SM, FL Switch 4000T-8POE-2SFP-R",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 config_transfer.cgi \u0438 software_update.cgi \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 FL SWITCH Phoenix Contact, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0438\u043d\u044f\u0442\u0438\u0435 \u043c\u0435\u0440 \u043f\u043e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u0412\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b) (CWE-78)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 config_transfer.cgi \u0438 software_update.cgi \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 FL SWITCH Phoenix Contact \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u041e\u0421. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u043d\u044a\u0435\u043a\u0446\u0438\u044f",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://nvd.nist.gov/vuln/detail/CVE-2018-10730\nhttps://ics-cert.us-cert.gov/advisories/ICSA-18-137-02\nhttps://cert.vde.com/en-us/advisories/vde-2018-007\nhttps://www.ptsecurity.com/ru-ru/research/threatscape/pt-2018-13/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-78",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,9)"
}

CVE-2018-10730 (GCVE-0-2018-10730)

Vulnerability from cvelistv5 – Published: 2018-05-17 19:00 – Updated: 2024-08-05 07:46

Summary

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

3 references

URL	Tags
https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02	x_refsource_MISC
https://cert.vde.com/de-de/advisories/vde-2018-004	x_refsource_CONFIRM
http://www.securityfocus.com/bid/104231	vdb-entryx_refsource_BID

Date Public

2018-05-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:46:46.962Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert.vde.com/de-de/advisories/vde-2018-004"
          },
          {
            "name": "104231",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104231"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-05-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-23T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert.vde.com/de-de/advisories/vde-2018-004"
        },
        {
          "name": "104231",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104231"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-10730",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-137-02"
            },
            {
              "name": "https://cert.vde.com/de-de/advisories/vde-2018-004",
              "refsource": "CONFIRM",
              "url": "https://cert.vde.com/de-de/advisories/vde-2018-004"
            },
            {
              "name": "104231",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104231"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-10730",
    "datePublished": "2018-05-17T19:00:00.000Z",
    "dateReserved": "2018-05-04T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:46:46.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ICSA-18-137-02

Vulnerability from csaf_cisa - Published: 2018-05-17 00:00 - Updated: 2018-05-17 00:00

Summary

PHOENIX CONTACT FL SWITCH 3xxx/4xxx/48xx Series

Scope

4 vulnerabilities in this advisory.

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2018-01072 (CVE-2018-10730)

CVE-2018-10730 (GCVE-0-2018-10730)

ICSA-18-137-02

Tags

Sightings

Nomenclature

Related by attack behaviour