CVE-2018-19003
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.56%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails to restrict the ability of an attacker to gain access to restricted information.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 2.56% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- ge/ex2100e firmware · ge/ls2100e firmware · ge/mark vle firmware
- Source
- ics-cert@hq.dhs.gov
References
- http://www.securityfocus.com/bid/106216Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-347-04Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/106216Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-347-04Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.