Loading vulnerabilities…
Loading vulnerabilities…
CVE-2018-1285
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
This record: live connection— last retrieved: 7 November 2026 at 02:35.
Vendors
Products
ABB Project Builder, ADM Project Builder Emerson in Emerson Integration Package, All contained DTMs in Diagnostic Manager, All contained DTMs in DTM Collection HART-Multiplexer, All contained DTMs in DTM Collection Level Control Technology used with Level Radar LCR20, LTC50, LTC51, LRC57, All contained DTMs in DTM Collection WirelessHART and 12 more
up to version <=1.1.1.1122
Published
11 May 2020
Last modified
17 June 2026
Taken directly from NVD, CISA or the vendor — sometimes in English, unchanged from the source.
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
NETWORK
Privileges required
NONE
User interaction
NONE
Confidentiality
High
Integrity
High
Availability
High
Probability of exploitation within 30 days
17.8%
Percentile
97e
Source: FIRST.org, updated on 6 November 2026.
External countermeasures are needed for the remaining products. The following protective measure is required for VisuNet devices and the PCs/Servers with an installed DTM: Restrict local access to the device, PC/Server and use user authentication to prevent unauthorized access.
Our own interpretation and context for the source data above.
IACS Radar assessment
Our own interpretation and context for this vulnerability — not an official source.
IACS Radar priority score
Based on CVSS 9.8, EPSS 17.8%, industrial relevance 40/100.
Combines CVSS, EPSS, KEV status, industrial relevance and exposure relevance — a complement to, not a replacement for, the individual scores below and above.
Conditions for exploitation
Operational impact & energy relevance
Possible loss of visibility of or control over the process upon successful exploitation.
No strong energy-sector-specific signals recognised; general OT/ICS relevance.
Recommended defensive measures
Industrial relevance score
Classification is provisional; manual verification by an OT security analyst is recommended.
Classified by IACS Radar-analysepijplijn (geautomatiseerd) on 7 November 2026.
IEC 62443 mapping
Automatic IACS Radar assessment based on the reported CWE weakness classification; not an official certification statement.