« Volver al listado

CVE-2018-17904

Estado: ModificadaMedia (6.1)—

Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Geovap — Reliance 4

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-17904",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "GEOVAP",
          "product": "Reliance 4 SCADA/HMI",
          "versions": [
            {
              "status": "affected",
              "version": "Version 4.7.3 Update 3 and prior."
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-25T22:29:00.220",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105738",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-298-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "http://www.securityfocus.com/bid/105738",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-298-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code."
    },
    {
      "lang": "es",
      "value": "Reliance 4 SCADA/HMI, en versiones 4.7.3 Update 3 y anteriores. La vulnerabilidad podría permitir que un atacante no autorizado inyecte código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T01:46:30.140",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:geovap:reliance_4:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DBBDF2A-74CF-4FEF-9CC4-AB36C0155D3A",
              "versionEndIncluding": "4.7.3"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance_4:4.7.3:update_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7ED9BF4-7672-4C36-9D42-6675DDA8B9F4"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance_4:4.7.3:update_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5989A79-C73B-45BB-A883-F612CDD97B43"
            },
            {
              "criteria": "cpe:2.3:a:geovap:reliance_4:4.7.3:update_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAA488AE-637E-49E8-B65D-33A091D551D9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}