Sign-up

ID

VAR-201810-0390


CVE

CVE-2018-14804


TITLE

Emerson AMS Device Manager Code injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-010967

DESCRIPTION

Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution. Emerson AMS Device Manager Contains a code injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The software provides predictive diagnostics, equipment configuration management, and more. An attacker can exploit these issues to gain elevated privileges, bypass certain security restrictions and perform unauthorized actions

Trust: 2.43

sources: NVD: CVE-2018-14804 // JVNDB: JVNDB-2018-010967 // CNVD: CNVD-2018-20678 // BID: 105406

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-20678

AFFECTED PRODUCTS

vendor:emersonmodel:ams device managerscope:lteversion:13.5

Trust: 1.0

vendor:emersonmodel:ams device managerscope:gteversion:12.0

Trust: 1.0

vendor:emersonmodel:ams device managerscope:eqversion:13.5

Trust: 0.9

vendor:emersonmodel:ams device managerscope:eqversion:13.0

Trust: 0.9

vendor:emersonmodel:ams device managerscope:eqversion:12.5

Trust: 0.9

vendor:emersonmodel:ams device managerscope:eqversion:12.0

Trust: 0.9

vendor:emersonmodel:ams device managerscope:eqversion:12.0 to 13.5

Trust: 0.8

vendor:emersonmodel:electric emerson electric ams device managerscope:gteversion:12.0,<=13.5

Trust: 0.6

vendor:emersonmodel:ams device managerscope:eqversion:13.1.1

Trust: 0.6

vendor:emersonmodel:ams device managerscope:eqversion:12.4

Trust: 0.3

vendor:emersonmodel:ams device managerscope:eqversion:12.3

Trust: 0.3

vendor:emersonmodel:ams device managerscope:eqversion:12.2

Trust: 0.3

vendor:emersonmodel:ams device managerscope:eqversion:12.1

Trust: 0.3

sources: CNVD: CNVD-2018-20678 // BID: 105406 // JVNDB: JVNDB-2018-010967 // CNNVD: CNNVD-201809-1249 // NVD: CVE-2018-14804

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-14804
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-14804
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-20678
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201809-1249
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2018-14804
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-20678
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2018-14804
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-20678 // JVNDB: JVNDB-2018-010967 // CNNVD: CNNVD-201809-1249 // NVD: CVE-2018-14804

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.8

problemtype:CWE-284

Trust: 1.0

sources: JVNDB: JVNDB-2018-010967 // NVD: CVE-2018-14804

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-1249

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201809-1249

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-010967

PATCH
title:AMS Device Managerurl:https://www.emerson.com/en-us/catalog/ams-ams-device-manager
Trust: 0.8
title:Patch for Emerson AMS Device Manager Code Execution Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/141837
Trust: 0.6
title:Emerson Electric AMS Device Manager Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85258
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-20678 // 
            
            
            
            JVNDB: JVNDB-2018-010967 // 
            
            
            
            CNNVD: CNNVD-201809-1249

EXTERNAL IDS
db:NVDid:CVE-2018-14804
Trust: 3.3
db:ICS CERTid:ICSA-18-270-01
Trust: 2.7
db:BIDid:105406
Trust: 2.5
db:JVNDBid:JVNDB-2018-010967
Trust: 0.8
db:CNVDid:CNVD-2018-20678
Trust: 0.6
db:CNNVDid:CNNVD-201809-1249
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-20678 // 
            
            
            
            BID: 105406 // 
            
            
            
            JVNDB: JVNDB-2018-010967 // 
            
            
            
            CNNVD: CNNVD-201809-1249 // 
            
            
            
            NVD: CVE-2018-14804

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-270-01
Trust: 2.7
url:http://www.securityfocus.com/bid/105406
Trust: 2.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14804
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-14804
Trust: 0.8
url:http://www2.emersonprocess.com/en-us/brands/amssuite/amsdevicemanager/pages/amsdevicemanager.aspx
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-20678 // 
            
            
            
            BID: 105406 // 
            
            
            
            JVNDB: JVNDB-2018-010967 // 
            
            
            
            CNNVD: CNNVD-201809-1249 // 
            
            
            
            NVD: CVE-2018-14804

CREDITS
Sergey Temnikov of Kaspersky Lab and Emerson
Trust: 0.3
sources:
            
            
            BID: 105406

SOURCES
db:CNVDid:CNVD-2018-20678
db:BIDid:105406
db:JVNDBid:JVNDB-2018-010967
db:CNNVDid:CNNVD-201809-1249
db:NVDid:CVE-2018-14804

LAST UPDATE DATE
2024-11-23T21:38:15.950000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-20678date:2018-10-12T00:00:00
db:BIDid:105406date:2018-09-27T00:00:00
db:JVNDBid:JVNDB-2018-010967date:2018-12-28T00:00:00
db:CNNVDid:CNNVD-201809-1249date:2019-10-17T00:00:00
db:NVDid:CVE-2018-14804date:2024-11-21T03:49:49.923

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-20678date:2018-10-11T00:00:00
db:BIDid:105406date:2018-09-27T00:00:00
db:JVNDBid:JVNDB-2018-010967date:2018-12-28T00:00:00
db:CNNVDid:CNNVD-201809-1249date:2018-09-28T00:00:00
db:NVDid:CVE-2018-14804date:2018-10-01T15:29:00.463