Medium severity · published Apr 17, 2018
CVE-2017-6020
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are…
5.3
CVSS
8.5%
EPSS
No
On KEV
Description
Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA software versions prior to version 4.1.0.3237 do not neutralize external input to ensure that users are not calling for absolute path sequences outside of their privilege level.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Laquis Scada · Lcds
before 4.1.0.3237 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6020
Third Party Advisory
http://www.securityfocus.com/bid/97055
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-082-01
Third Party Advisory
https://www.exploit-db.com/exploits/42885/
More from Laquis Scada
9.8
CVE-2018-18996
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the…
9.8
CVE-2018-18998
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges
9.8
CVE-2018-17897
LAquis SCADA Versions 4.1.0.3870 and prior has several integer overflow to buffer overflow vulnerabilities, which may allow remote code execution
9.8
CVE-2018-17895
LAquis SCADA Versions 4.1.0.3870 and prior has several out-of-bounds read vulnerabilities, which may allow remote code execution
9.8
CVE-2018-17893
LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution