CVE-2018-17922

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authentication.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522 CWE-532

Affected software

Vendor	Product	Versions
unknown	Circontrol CirCarLife all versions prior to 4.3.1	Circontrol CirCarLife all versions prior to 4.3.1

References

http://www.securityfocus.com/bid/105816Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105816Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-305-03Third Party Advisory, US Government Resource

Timeline

Published: Nov 2, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179236.9SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may abl CVE-2018-179248.6Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could s CVE-2018-179254.8Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX CVE-2018-179264.3The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicio CVE-2018-179277.8In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple out-of-bounds write vulnerabilities may be exploited by CVE-2018-179286.5The product CMS-770 (Software Versions 1.7.1 and prior)is vulnerable that an attacker can read sensitive configuration files by bypassing th CVE-2018-179297.8In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple stack-based buffer overflow vulnerabilities may be explo CVE-2018-17936.1IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows user CVE-2018-179309.8A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior, which may allow remote CVE-2018-179316.8If an attacker has physical access to the VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) they may be CVE-2018-179329.8JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, whic CVE-2018-179338.8VGo Robot (Versions 3.0.3.52164 and 3.0.3.53662. Prior versions may also be affected) connected to the VGo XAMPP. User accounts may be able