CVE-2018-19016

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earlier. A remote attacker could send a crafted UDP packet to the SNMP service causing a denial-of-service condition to occur until the affected product is restarted.

References

https://ics-cert.us-cert.gov/advisories/ICSA-19-036-02

Details

Source: MITRE

Published: 2019-03-27

Updated: 2019-10-09

Type: CWE-20

Risk Information

CVSS v2

Base Score: 7.8

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 3.9

Severity: HIGH

Tenable Plugins

View all (2 total)

IDNameProductFamilySeverity
500157Rockwellautomation Ethernet\/ip Improper Input ValidationTenable.otSCADA
high
720156Rockwell Automation 1756-EWEB <= 5.001 and 1768-EWEB <= 2.005 SNMP Denial of ServiceNessus Network MonitorSCADA
high