« Volver al listado

CVE-2018-7246

Estado: ModificadaCrítica (9.8)—

A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. he integrated web server (Port 80/443/TCP) of the affected devices could allow remote attackers to discover an administrative account. If default on device, it is not using a SSL in settings and if multiple request of the page "Access Control" (IP-address device/ups/pas_cont.htm) account data will be sent in cleartext

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Schneider-electric — 66074 MGE Network Management Card Transverse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-7246",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": true,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "Schneider Electric SE",
          "product": "66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS",
          "versions": [
            {
              "status": "affected",
              "version": "MGE Network Management Card Transverse, part number: SF66074. All card versions affected, when installed in following products: MGE Galaxy 5000, MGE Galaxy 6000, MGE Galaxy 9000, MGE EPS 7000, MGE EPS 8000, MGE EPS 6000, MGE Comet UPS, MGE Galaxy PW, MGE Galaxy 3000, MGE Galaxy 4000"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-18T20:29:00.577",
  "references": [
    {
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-074-01/",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A cleartext transmission of sensitive information vulnerability exists in Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. he integrated web server (Port 80/443/TCP) of the affected devices could allow remote attackers to discover an administrative account. If default on device, it is not using a SSL in settings and if multiple request of the page \"Access Control\" (IP-address device/ups/pas_cont.htm) account data will be sent in cleartext"
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de transmisión en texto claro de información sensible en 66074 MGE Network Management Card Transverse, de Schneider Electric, instalado en MGE UPS y MGE STS. El servidor web integrado (Puerto 80/443/TCP) de los dispositivos afectados podría permitir que atacantes remotos descubran una cuenta administrativa. Por defecto, si en el dispositivo no se emplea SSL en las opciones y si hay múltiples peticiones de la página \"Access Control\" (IP-address device/ups/pas_cont.htm), los datos de la cuenta se enviarán en texto claro."
    }
  ],
  "lastModified": "2026-06-17T02:02:52.020",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:66074_mge_network_management_card_transverse:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DBB8697-64F8-4D15-8B14-CDD51E99FBCF"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_comet_ups:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F9837318-C9B6-448E-B701-40929C96795A"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_eps_6000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "98078458-B5AB-4AD2-9E57-390591469F37"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_eps_7000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "05DE2424-0969-491D-A414-81A648F2F801"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_eps_8000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "60DC5EF0-1929-4D67-89BF-47D6F6848411"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_galaxy_3000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "955C94DD-90E6-4AB1-87CC-4EDACEA47DF0"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_galaxy_4000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7FCAE877-B3E9-4970-B0EE-49C64C85715C"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_galaxy_5000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4EBFA4F2-6574-4D58-9B0C-317229DF503E"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_galaxy_6000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "790BF7D0-4E2D-4607-8C47-C4B707538E66"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_galaxy_9000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "54A1FC87-5319-4F69-9228-C664D505B1CC"
            },
            {
              "criteria": "cpe:2.3:h:schneider-electric:mge_galaxy_pw:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "59D9633E-051F-427A-BADA-61BC8501AAE9"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}