CVE-2018-7243
9.8
CRITICAL · CVSS 3.0 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. The integrated web server (Port 80/443/TCP) of the affected devices could allow a remote attacker to get a full access to device, bypassing the authorization system.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.77% — more likely to be exploited than 86% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-04-18 |
| Last modified | 2026-06-17 |
Affected (11)
| Vendor | Product |
|---|---|
| schneider-electric | 66074 mge network management card transverse |
| schneider-electric | mge comet ups |
| schneider-electric | mge eps 6000 |
| schneider-electric | mge eps 7000 |
| schneider-electric | mge eps 8000 |
| schneider-electric | mge galaxy 3000 |
| schneider-electric | mge galaxy 4000 |
| schneider-electric | mge galaxy 5000 |
| schneider-electric | mge galaxy 6000 |
| schneider-electric | mge galaxy 9000 |
| schneider-electric | mge galaxy pw |
References
→ the Explorer · watch your stack · NVD