« Volver al listado

CVE-2018-7802

Estado: ModificadaAlta (8.8)—

A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Schneider-electric — Evlink Parking Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-7802",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cybersecurity@se.com",
      "affectedData": [
        {
          "vendor": "Schneider Electric SE",
          "product": "EVLink Parking v3.2.0-12_v1 and earlier",
          "versions": [
            {
              "status": "affected",
              "version": "EVLink Parking v3.2.0-12_v1 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-24T16:29:00.827",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/106807",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cybersecurity@se.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/106807",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-031-01",
      "tags": [
        "Mitigation",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.schneider-electric.com/en/download/document/SEVD-2018-354-01/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de inyección SQL en EVLink Parking, en versiones v3.2.0-12_v1 y anteriores, lo que podría otorgar acceso a la interfaz web con privilegios totales."
    }
  ],
  "lastModified": "2026-06-17T02:03:45.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:schneider-electric:evlink_parking_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB8E9B41-C029-4370-B192-58617234E6AE",
              "versionEndIncluding": "3.2.0-12"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:schneider-electric:evlink_parking:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C3A3C53B-06E7-4E10-B3DB-8319A0F8FCFD"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cybersecurity@se.com"
}