CVE-2018-17908

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	WebAccess Versions 8.3.2 and prior.	WebAccess Versions 8.3.2 and prior.

References

http://www.securityfocus.com/bid/105736Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041957Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-298-02Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105736Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041957Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-298-02Third Party Advisory, US Government Resource

Timeline

Published: Oct 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179097.8When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed m CVE-2018-17914.9IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request proper CVE-2018-179107.8WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow c CVE-2018-179117.8LAquis SCADA Versions 4.1.0.3870 and prior has several stack-based buffer overflow vulnerabilities, which may allow remote code execution.CVE-2018-179127.5An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure CVE-2018-179137.8A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an at CVE-2018-179149.8InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vuln CVE-2018-179159.8All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMey CVE-2018-179169.8InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote CVE-2018-179175.3All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potenti CVE-2018-179189.8Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page.CVE-2018-179196.5All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "defa