CVE-2018-7522 Memory corruption in Triconex Tricon
Attackers can modify fixed memory locations during system calls to gain supervisor-level access and control system states in Schneider Electric Triconex devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7522?
CVE-2018-7522 is a medium-severity memory corruption vulnerability in Schneider Electric Triconex Tricon, published on 4 May 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, when a system call is made, registers are stored to a fixed memory location. Modifying the data in this location could allow attackers to gain supervisor-level access and control system states.
Weakness: CWE-119
Which versions are affected by CVE-2018-7522?
It affects 1 product.
Products include Schneider-Electric Triconex Tricon Mp 3008 Firmware.
How do I fix CVE-2018-7522?
No fix has been published for CVE-2018-7522 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-7522 being exploited?
There is no known exploitation of CVE-2018-7522 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric Triconex Tricon
Sources
Also known as GHSA-293h-57f9-wc4c.