CVE-2018-8872

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-04 · updated 2026-06-17
Weakness: CWE-119

Description

In Schneider Electric Triconex Tricon MP model 3008 firmware versions 10.0-10.4, system calls read directly from memory addresses within the control program area without any verification. Manipulating this data could allow attacker data to be copied anywhere within memory.

Affected products

Schneider Electric Triconex Tricon: from 10.0 through 10.4

References

http://www.securityfocus.com/bid/103947
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02
https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/
http://www.securityfocus.com/bid/103947
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02
https://www.schneider-electric.com/en/download/document/SEVD-2017-347-01/

Get alerted when CVE-2018-8872 or the next vulnerability affects your stack