CVE-2018-25108

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can cause a DoS in the controller due to uncontrolled resource consumption.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

VendorProductVersions
WAGO750-8100 (Controller PFC100)<= 02.05.23(08)
WAGO750-831 (Controller BACnet/IP)<= 01.02.29(09)
WAGO750-880 (Controller ETH)<= 01.07.03(10)
WAGO750-889 (Controller KNX IP)<= 01.07.13(10)

References

Timeline

Published
Jan 16, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2018

CVE-2018-251096.4A vulnerability has been found in Nintendo Animal Crossing, Doubutsu no Mori+ and Doubutsu no Mori e+ 1.00/1.01 on GameCube and classified aCVE-2018-251107.5Marked prior to version 0.3.17 is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to catastrophic backtracking in seCVE-2018-251114.4django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.CVE-2018-251127.5An unauthenticated remote attacker may use an uncontrolled resource consumption in the IEC 61131 program of the affected products by creatinCVE-2018-251138.7An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allCVE-2018-251149.3A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default configuration and misCVE-2018-251159.8Multiple D-Link DIR-series routers, including DIR-110, DIR-412, DIR-600, DIR-610, DIR-615, DIR-645, and DIR-815 firmware version 1.03, contaCVE-2018-251166.1MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. AttackeCVE-2018-251179.3VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain comproCVE-2018-2511810.0GeoVision embedded IP devices, confirmed on GV-BX1500 and GV-MFD1501, contain a remote command injection vulnerability via /PictureCatch.cgiCVE-2018-251196.1Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validationCVE-2018-251209.8D-Link DNS-343 ShareCenter devices running firmware versions up to and including 1.05 contain a command injection vulnerability in the Mail
CVE-2018-25108: High severity, CVSS 7.5 | Vulnix