CVE-2018-18990

LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive informatio...

Exploitation likely. EPSS gives it a 39% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.05.3Medium EPSS percentile99th39% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2019-02-05Updated 2024-11-21Sources: CVE.org, NVD, CSAF

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check which version of LCDS Laquis SCADA (laquis scada) you are running in your environment.
If your version is older than 4.1.0.4150, plan an upgrade.
Upgrade LCDS Laquis SCADA to 4.1.0.4150 (or later) to close the path-validation issue.
After upgrading, verify the SCADA file-related functions you use still work as expected and review application logs for unusual file access attempts.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

In plain language

Written by AI from the record

CVE-2018-18990 is a flaw in LCDS Laquis SCADA that can let an attacker read sensitive files by using a specially crafted file path; for most small businesses it’s a low-to-medium worry, but you should update if you run this SCADA software and can reach its interfaces.

CVE-2018-18990 is a path-handling weakness (CWE-23/CWE-22) in LCDS Laquis SCADA where a user-supplied path is used in file operations before proper validation, potentially enabling information disclosure; it was fixed in version 4.1.0.4150.

If you're affected

Sensitive configuration file disclosure
Operational setup details exposed
Potential exposure of embedded credentials
Limited disruption to operations

What is it

Imagine a software “file chooser” that should only allow safe, pre-approved folders. In this case, LCDS Laquis SCADA can be tricked into using a user-provided file path before it’s properly checked. That can allow someone to peek at sensitive internal files (like configuration details) without needing to shut the system down.

Who is affected

This matters if your business operates or maintains LCDS Laquis SCADA. If you use this SCADA software and it’s reachable by an attacker (for example, through a network-facing interface), then the crafted-path mistake could be used to access sensitive files. Otherwise, risk is limited.

How urgent is it

This vulnerability is fixed and is not currently listed as actively exploited in CISA KEV, and there’s no public exploit code on record. However, the issue is about file access with user-controlled paths, so you should still prioritize upgrading to the fixed version—especially if the SCADA system is reachable from broader networks.

What to do — in detail

Confirm exposure (versions and placement)

Identify the exact LCDS Laquis SCADA version installed on each relevant server/workstation.
Confirm whether any LCDS Laquis SCADA features that involve file operations are accessible from other systems (and especially from outside your trusted network).

Determine whether you need action

If the installed version is prior to 4.1.0.4150, you are in the affected range described for this issue.

Upgrade to the fixed release

Upgrade LCDS Laquis SCADA to 4.1.0.4150 (or a later release from your vendor, if available).
Plan the upgrade according to your normal change window, since SCADA systems often require careful maintenance scheduling.
After upgrade, validate key workflows that interact with the SCADA system to ensure nothing breaks.

Temporary mitigation (if you cannot patch immediately)

Reduce exposure: restrict network access so only trusted hosts can reach the LCDS Laquis SCADA interfaces.
Apply access controls consistent with your network/security policy (e.g., allow-listing management systems, blocking inbound access from untrusted networks).

What to monitor after the upgrade

Review application/server logs for suspicious file access behavior around the time of access attempts.
Look for repeated errors or abnormal activity related to file paths or file operations in LCDS Laquis SCADA logs.

Technical context

CVE-2018-18990 describes a path-validation flaw in LCDS Laquis SCADA (laquis scada) where user-supplied paths can be used in file operations before proper validation, aligning with CWE-23 (Relative Path Traversal) and CWE-22 (Path Traversal). The practical consequence is potential information disclosure of sensitive files.

Findings indicate:

No KEV listing (not confirmed as actively exploited via CISA KEV).
No public exploit code is on record.
A vendor fix is available: “laquis scada → fixed in 4.1.0.4150.”

Given the nature of the flaw, real-world risk depends on whether an attacker can reach the relevant LCDS Laquis SCADA interface(s) that accept or indirectly influence the file path input. There is no evidence here of widespread exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

39% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

22 events over 2787 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-28EPSS band changemoderate → 0epss band change

Affected products

ICS-CERTcommercialaka moxa iks, eds, cx-supervisor, lcds laquis scada
- LCDS Laquis SCADAEmbeddedICS / OT / IoT / plc-scada-hmi
lcdscommercial
- laquis scadaEmbeddedICS / OT / IoT / plc-scada-hmi

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact