CVE-2018-18995

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web interfaces, which could enable various effects vectors, including conducting device resets, reading or modifying registers, and changing configuration settings such as IP addresses.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	ABB GATE-E1 and GATE-E2	All versions

References

http://www.securityfocus.com/bid/106247Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/106247Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jan 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-189969.8LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an att CVE-2018-189976.1Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrativ CVE-2018-189989.8LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system wit CVE-2018-189997.3WebAccess/SCADA, WebAccess/SCADA Version 8.3.2 installed on Windows 2008 R2 SP1. Lack of proper validation of user supplied input may allow CVE-2018-19005.4IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows u CVE-2018-190005.3LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.CVE-2018-190014.3Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protect CVE-2018-190027.8LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, w CVE-2018-190037.5GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All ve CVE-2018-190043.3LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data CVE-2018-190057.8Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing CVE-2018-190064.8OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displ