CVE-2018-18990

LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive informatio...

Published: Feb 5, 2019Updated: Nov 21, 2024 Sources: CVE List NVD csafCWE-23

5.3MEDIUM

Description

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

In plain language

AI Low urgency

CVE-2018-18990 is a flaw in LCDS Laquis SCADA that can let an attacker read sensitive files by using a specially crafted file path; for most small businesses it’s a low-to-medium worry, but you should update if you run this SCADA software and can reach its interfaces.

Executive summary

CVE-2018-18990 is a path-handling weakness (CWE-23/CWE-22) in LCDS Laquis SCADA where a user-supplied path is used in file operations before proper validation, potentially enabling information disclosure; it was fixed in version 4.1.0.4150.

If affected, business impact

Sensitive configuration file disclosureOperational setup details exposedPotential exposure of embedded credentialsLimited disruption to operations

What to do now

Check which version of LCDS Laquis SCADA (laquis scada) you are running in your environment.
If your version is older than 4.1.0.4150, plan an upgrade.
Upgrade LCDS Laquis SCADA to 4.1.0.4150 (or later) to close the path-validation issue.
After upgrading, verify the SCADA file-related functions you use still work as expected and review application logs for unusual file access attempts.

Usually a quick update

What is it

Imagine a software “file chooser” that should only allow safe, pre-approved folders. In this case, LCDS Laquis SCADA can be tricked into using a user-provided file path before it’s properly checked. That can allow someone to peek at sensitive internal files (like configuration details) without needing to shut the system down.

Who is affected

This matters if your business operates or maintains LCDS Laquis SCADA. If you use this SCADA software and it’s reachable by an attacker (for example, through a network-facing interface), then the crafted-path mistake could be used to access sensitive files. Otherwise, risk is limited.

How urgent is it

This vulnerability is fixed and is not currently listed as actively exploited in CISA KEV, and there’s no public exploit code on record. However, the issue is about file access with user-controlled paths, so you should still prioritize upgrading to the fixed version—especially if the SCADA system is reachable from broader networks.

What to do — in detail

Confirm exposure (versions and placement)

Identify the exact LCDS Laquis SCADA version installed on each relevant server/workstation.
Confirm whether any LCDS Laquis SCADA features that involve file operations are accessible from other systems (and especially from outside your trusted network).

Determine whether you need action

If the installed version is prior to 4.1.0.4150, you are in the affected range described for this issue.

Upgrade to the fixed release

Upgrade LCDS Laquis SCADA to 4.1.0.4150 (or a later release from your vendor, if available).
Plan the upgrade according to your normal change window, since SCADA systems often require careful maintenance scheduling.
After upgrade, validate key workflows that interact with the SCADA system to ensure nothing breaks.

Temporary mitigation (if you cannot patch immediately)

Reduce exposure: restrict network access so only trusted hosts can reach the LCDS Laquis SCADA interfaces.
Apply access controls consistent with your network/security policy (e.g., allow-listing management systems, blocking inbound access from untrusted networks).

What to monitor after the upgrade

Review application/server logs for suspicious file access behavior around the time of access attempts.
Look for repeated errors or abnormal activity related to file paths or file operations in LCDS Laquis SCADA logs.

Technical context

CVE-2018-18990 describes a path-validation flaw in LCDS Laquis SCADA (laquis scada) where user-supplied paths can be used in file operations before proper validation, aligning with CWE-23 (Relative Path Traversal) and CWE-22 (Path Traversal). The practical consequence is potential information disclosure of sensitive files.

Findings indicate:

No KEV listing (not confirmed as actively exploited via CISA KEV).
No public exploit code is on record.
A vendor fix is available: “laquis scada → fixed in 4.1.0.4150.”

Given the nature of the flaw, real-world risk depends on whether an attacker can reach the relevant LCDS Laquis SCADA interface(s) that accept or indirectly influence the file path input. There is no evidence here of widespread exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.