What is the CVSS score of CVE-2018-7758?

CVE-2018-7758 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Micom P141 Firmware CVE-2018-7758

MEDIUM

Insufficient Session Expiration (CWE-613)

2018-04-18 cybersecurity@se.com

Schneider Electric Denial Of Service Micom P141 Firmware Micom P142 Firmware Micom P143 Firmware Micom P145 Firmware Micom P642 Firmware Micom P643 Firmware Micom P645 Firmware Micom P849 Firmware Micom P746 Firmware Micom P841A Firmware Micom P841B Firmware Micom P443 Firmware Micom P445 Firmware Micom P446 Firmware Micom P441 Firmware Micom P442 Firmware Micom P444 Firmware Micom P541 Firmware Micom P542 Firmware Micom P543 Firmware Micom P544 Firmware Micom P545 Firmware Micom P546 Firmware

6.5

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Apr 18, 2018 - 20:29 nvd

MEDIUM 6.5

DescriptionNVD

A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Ethernet Board, and MiCOM Px4x Rejuvenated could lose network communication in case of TCP/IP open requests on port 20000 (DNP3oE) if an older TCI/IP session is still open with identical IP address and port number.

AnalysisAI

A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Ethernet Board, and MiCOM Px4x Rejuvenated. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-613. A denial of service vulnerability exists in Schneider Electric's MiCOM Px4x (P540 range excluded) with legacy Ethernet board, MiCOM P540D Range with Legacy Ethernet Board, and MiCOM Px4x Rejuvenated could lose network communication in case of TCP/IP open requests on port 20000 (DNP3oE) if an older TCI/IP session is still open with identical IP address and port number. Affected products include: Schneider-Electric Micom P141 Firmware, Schneider-Electric Micom P142 Firmware, Schneider-Electric Micom P143 Firmware, Schneider-Electric Micom P145 Firmware, Schneider-Electric Micom P642 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.