Unscored severity · published May 26, 2015
CVE-2015-1008
SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input
–
CVSS
1.3%
EPSS
No
On KEV
Description
SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Ams Device Manager · Emerson
through 12.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1008
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1008
Vendor Advisory
http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability
www.securityfocus.com
http://www.securityfocus.com/bid/74774
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01
More from Ams Device Manager
9.8
CVE-2018-14804
Emerson AMS Device Manager v12.0 to v13.5
6.5
CVE-2018-14808
Emerson AMS Device Manager v12.0 to v13.5