CVE-2018-17893 Null dereference in LAquis SCADA

Critical 9.8 Published 17 Oct 2018 Updated 17 Sep 2024

Remote attackers can execute arbitrary code via an untrusted pointer dereference in LAquis SCADA, posing a critical risk to industrial control systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17893?

CVE-2018-17893 is a critical vulnerability in LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME LAquis SCADA, published on 17 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability, which may allow remote code execution.

Weakness: CWE-476, CWE-822

Which versions are affected by CVE-2018-17893?

It affects 1 product.

Products include Lcds Laquis Scada.

How do I fix CVE-2018-17893?

No fix has been published for CVE-2018-17893 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-17893 being exploited?

There is no known exploitation of CVE-2018-17893 in the wild and no public exploit code.

Sources

Also known as GHSA-5733-vc7q-45fw.