CVE-2018-3989
At a glance
- Source
- NVD
- EPSS
- EPSS 0.57 % · percentile 47 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- talos
- NVD status
- Modified
Description
An exploitable kernel memory disclosure vulnerability exists in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys Version 6.40 (Build 2400).A specially crafted IRP request can cause the driver to return uninitialized memory, resulting in kernel memory disclosure. An attacker can send an IRP request to trigger this vulnerability.
Weaknesses (CWE)
- CWE-908 — Use of Uninitialized Resource
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.3 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N | talos |
| CVSS 3.0 | MEDIUM 4.3 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N | NVD · talos-cna@cisco.com (Secondary) |
| CVSS 3.0 | MEDIUM 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2018-15775
- GCVE · GCVE-0-2018-3989
CERT-FR advisories
- CERTFR-2019-AVI-207 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2019-AVI-078 — SCADA Multiples vulnérabilités dans Siemens WinCC OA · cert.ssi.gouv.fr
- CERTFR-2019-AVI-052 — SCADA Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:wibu:wibukey:6.40:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |