CVE-2018-18997

MEDIUM

ABB GATE-E1 and GATE-E2 - Unauthenticated Stored Cross-Site Scripting via Device Properties

Title source: llm

Description

Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrative web interface to insert an HTML/Javascript payload into any of the device properties, which may allow an attacker to display/execute the payload in a visitor browser.

References (2)

Core 2

Core References

Mitigation, Third Party Advisory, US Government Resource x_refsource_misc

https://ics-cert.us-cert.gov/advisories/ICSA-18-352-01

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106247

Scores

CVSS v3 6.1

EPSS 0.0026

EPSS Percentile 48.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

abb/gate-e1_firmware

abb/gate-e2_firmware

Published Jan 03, 2019

Tracked Since Feb 18, 2026