Vulnerability in Abb Microscada
CVE-2018-1168
This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (21.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 21.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Abb Microscada — versions 9.3 with FP 1-2-3
- Hitachienergy Sys600
- Hitachienergy Sys600 Firmware — versions 9.0, 9.1, 9.1.5
Weakness classification (CWE)
Public proof-of-concept exploits
References
- library.e.abb.com/public/7a88a74b12bb492ea138b1f2365d00f6/ABBVU-PGGA-33888_ABB_… (Mitigation, Vendor Advisory)
- zerodayinitiative.com/advisories/ZDI-18-141 (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-1168?
- CVE-2018-1168 is a high-severity vulnerability in Abb Microscada, classified under Improper Access Control. CVSS score: 7.8/10. Published 2018-02-21.
- How severe is CVE-2018-1168?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2018-1168 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.