CVE-2018-14805

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOMS web.config file are present. Both conditions are required to exploit this vulnerability.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
ICS-CERT	ABB eSOMS	Version 6.0.2

References

http://www.securityfocus.com/bid/105169Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-240-04Third Party Advisory, US Government Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107046A5821&LanguageCode=en&DocumentPartId=&Action=LaunchMitigation, Vendor Advisory
http://www.securityfocus.com/bid/105169Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-240-04Third Party Advisory, US Government Resource
https://search.abb.com/library/Download.aspx?DocumentID=9AKK107046A5821&LanguageCode=en&DocumentPartId=&Action=LaunchMitigation, Vendor Advisory

Timeline

Published: Aug 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-148069.8Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.CVE-2018-148079.8A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow re CVE-2018-148086.5Emerson AMS Device Manager v12.0 to v13.5. Non-administrative users are able to change executable and library files on the affected product CVE-2018-148099.8Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution.CVE-2018-14815.3IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information CVE-2018-148108.8WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated u CVE-2018-148119.8Fuji Electric V-Server 4.0.3.0 and prior, Multiple untrusted pointer dereference vulnerabilities have been identified, which may allow remot CVE-2018-148127.8An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1 CVE-2018-148139.8Fuji Electric V-Server 4.0.3.0 and prior, A heap-based buffer overflow vulnerability has been identified, which may allow remote code execut CVE-2018-148146.5WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied dat CVE-2018-148159.8Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code exec CVE-2018-148169.8Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an