CVE-2018-8872

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Schneider Electric	Triconex Tricon	MP model 3008 firmware versions 10.0-10.4

References

http://www.securityfocus.com/bid/103947Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02Third Party Advisory, US Government Resource
https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/Vendor Advisory
http://www.securityfocus.com/bid/103947Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02Third Party Advisory, US Government Resource
https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/Vendor Advisory

Timeline

Published: May 4, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-88737.8In 2345 Security Guard 3.6, the driver file (2345NetFirewall.sys) allows local users to cause a denial of service (BSOD) or possibly have un CVE-2018-88747.8In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif CVE-2018-88757.8In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif CVE-2018-88767.8In 2345 Security Guard 3.6, the driver file (2345Wrath.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecif CVE-2018-88775.3Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices a CVE-2018-88785.3Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices a CVE-2018-88799.8Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devi CVE-2018-88807.5Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP informat CVE-2018-88817.3Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated CVE-2018-88827.8Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.CVE-2018-88837.8Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_fl CVE-2018-88857.0screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypa