CVE-2018-1285
highpriority · attend · 55EPSS 0.178 · 97 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedpepperl_fuchs_psirt
The following affected DTM products can be updated to the listed version: | Item | Version | |--------------------------------------------|----------------| | FieldConnex DTM Collection | 1.7.1.2159 | | Diagnostic Manager | 2.2.3.3527 | | FieldConnex Diagnostic Gateway FF DTM | 2.2.3.3527 | | FDH-1 Manager | 1.0.2.1049 | | ABB Project Builder | 1.1.2.1134 | | Honeywell Integration Package | 1.1.3.0 | | Emerson Integration Package [ADM Project Builder Emerson] | 1.1.4.1474 | | Emerson Integration Package [AMS Alert Adapter] | 1.1.3.72 | | DTM Collection HART-Multiplexer | 2.0.1.208 | UPDATE A The following affected VisuNet products can be updated to the listed version: | Item | Version | |------------------------------------------|---------------| | VisuNet RM Shell 5 (2016 LTSB) | 5.5.1.1200 | | VisuNet RM Shell 5 (2019 LTSC) | 5.6.0.1383 | | VisuNet Factory Reset | 6.1.1.262 | | VisuNet Control Center | 4.8.0.1596 | | VisuNet GXP PC Service Tool | 1.1.1 | END UPDATE A
- FixedOseon (Storage)trumpf_psirt
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.
- FixedTruTops Boosttrumpf_psirt
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.
- FixedTruTops Celltrumpf_psirt
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.
- FixedTruTops Classictrumpf_psirt
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.
- FixedTruTops Fab (Storage)trumpf_psirt
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.
- FixedTruTops Marktrumpf_psirt
New versions are available for the affected products. Install new versions as provided by TRUMPF SE + Co. KG. To aquire these versions please contact your TRUMPF Service with the PR number 500879.
- FixedAADvance Standalone OPC-DA Servercisa_csaf_ot
AADvance Standalone OPC-DA Server: Update to v2.02 or later
- Fixed95057C-FTHTWXCT11cisa_csaf_ot
95057C-FTHTWXCT11: Versions v5.00.00 and later
- FixedASE2000cisa_csaf_ot
Avoid using IEC 60870-5-104 over TLS across untrusted or shared networks; place ASE2000 hosts on an isolated, segmented network reachable only by intended peers.
- FixedBD Alaris Systems Managercisa_csaf_ot
BD Alaris Systems Manager Software version 12.5.1 - Remediates CVE-2018-1285, CVE-2023-30563, CVE-2023-30564, and CVE-2023-30565; partially remediates CVE-2023-30562
- FixedCalculation Servicescisa_csaf_ot
Calculation Services, version 1.1.1 - Remediates CVE-2018-1285, CVE-2023-30563, CVE-2023-30564, and CVE-2023-30565; partially remediates CVE-2023-30562
- Mitigationpepperl_fuchs_psirt
External countermeasures are needed for the remaining products. The following protective measure is required for VisuNet devices and the PCs/Servers with an installed DTM: Restrict local access to the device, PC/Server and use user authentication to prevent unauthorized access.
- MitigationAADvance Standalone OPC-DA Servercisa_csaf_ot
Customers using the affected software are encouraged to apply the risk mitigations, if possible.
- Mitigation95057C-FTHTWXCT11cisa_csaf_ot
Rockwell Automation released a product update addressing this vulnerability:
- MitigationASE2000cisa_csaf_ot
ASE/Kalkitech provides an upgraded version 2.38 that fixes both vulnerabilities and customers are advised to upgrade to version 2.38. In version 2.38 the bundled log4net library is upgraded to version 3.3.1.0, and the IEC 60870-5-104 TLS client certificate validation logic is corrected to ensure proper validation of certificate error conditions.
- MitigationBD Alaris Guardrails Editorcisa_csaf_ot
Adhere to industry security best practices regarding access control, identification and authorization, personnel security, and physical protection of assets, as recommended by NIST SP 800-171 Rev. 2.
- MitigationBD Alaris Point-of-Care Unit (PCU) Model 8015cisa_csaf_ot
Adhere to industry security best practices regarding access control, identification and authorization, personnel security, and physical protection of assets, as recommended by NIST SP 800-171 Rev. 2.
- MitigationBD Alaris Systems Managercisa_csaf_ot
Adhere to industry security best practices regarding access control, identification and authorization, personnel security, and physical protection of assets, as recommended by NIST SP 800-171 Rev. 2.
- MitigationCQI Reportercisa_csaf_ot
Adhere to industry security best practices regarding access control, identification and authorization, personnel security, and physical protection of assets, as recommended by NIST SP 800-171 Rev. 2.
- MitigationCalculation Servicescisa_csaf_ot
Adhere to industry security best practices regarding access control, identification and authorization, personnel security, and physical protection of assets, as recommended by NIST SP 800-171 Rev. 2.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 3–9.8
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (103)
Products and version ranges known to be affected.
- netapp manageability software development kitall versionsnvdUScpe:2.3:a:netapp:manageability_software_development_kit:*:*:*:*:*:*:*:*
- oracle application testing suite= 13.3.0.1nvdUScpe:2.3:a:oracle:application_testing_suite:*:*:*:*:*:*:*:*
advisories (7)
Vendor and ecosystem advisories describing this.
- VDE-2021-041Pepperl+Fuchs: Multiple DTM and VisuNet Software affected by log4net vulnerability2021-10-26csaf · pepperl_fuchs_psirtDE
Critical vulnerabilities have been discovered in the utilized component log4net by Apache Software Foundation. UPDATE A: Remediation: added fixed VisuNet Products
- VDE-2024-004TRUMPF: Multiple products affected by log4net vulnerability2025-04-22csaf · trumpf_psirtDE
The versions of TRUMPF products stated below are including a version of log4net that's prone to XXE (External XML Entities) attacks under certain circumstances. This means, the log4net code can be tricked into loading externally hosted, potentially malicious XML code and possibly executing it. This vulnerability allows for the execution of remote XML code, possibly resulting in unauthorized (remote) access to, change of data or disruption of the whole system running the vulnerable application.
- GHSA-2cwj-8chv-9pp9XML External Entity attack in log4net2021-01-29ghsa · osvUS
Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
- ICSA-24-226-02Rockwell Automation AADvance Standalone OPC-DA Server2024-08-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code in the affected product.
- ICSA-25-142-02Rockwell Automation FactoryTalk Historian ThingWorx2025-05-22icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to launch XXE-based attacks on applications that accept malicious log4net configuration files.
- ICSA-26-239-04Applied Systems Engineering ASE2000 V2 Communications Test Set2026-08-27icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to impersonate the trusted peer, complete the TLS handshake, and read or modify the protected communications.
- ICSMA-23-194-01BD Alaris System with Guardrails Suite MX2023-07-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to compromise sensitive data, hijack a session, modify firmware, make changes to system configurations, among other system impacts.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (60)
External citations — patches, advisories, analysis.
- http://www.nsfocus.net/vulndb/47614cnnvd
- https://issues.apache.org/jira/browse/LOG4NET-575cnnvd
- https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872@%3Cdev.logging.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9@%3Cdev.logging.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3@%3Cdev.logging.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f@%3Cdev.logging.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a@%3Cdev.logging.apache.org%3Ecnnvd
- https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866@%3Cdev.logging.apache.org%3Ecnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan