CVE-2018-1168: abb abb microscada Improper Access Control
Vulnerability summary
CVE-2018-1168 is a high (CVSS 7.8) Improper Access Control vulnerability in abb abb microscada. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.7% of scored vulnerabilities.
Timeline
- 21-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
0.00 pp
From 0.31% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Abb1 product
- abb microscada9.3 with FP 1-2-3
Hitachienergy1 product
- sys600_firmware9.0 | 9.1 | 9.1.5 | 9.2 | 9.4
2 vendors · 2 products