CVE-2018-12634: CirCarLife SCADA unauthenticated information exposure via direct URI request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and a very high EPSS score make this a critical exposure for any internet- or network-reachable CirCarLife Scada instance.

What it is

CirCarLife Scada before 4.3 exposes sensitive information when an attacker directly requests the html/log or services/system/info.html URI. The flaw is a CWE-200 information exposure reachable over the network without authentication, and the record assigns it a critical CVSS 3.1 score of 9.8. Because the exposed endpoints are administrative log and system information pages, the leak can reveal operational details useful for follow-on attacks.

Impact

An attacker gains access to log data and system information from the SCADA installation without any credentials. That information can disclose internal paths, configuration and operational details that support further intrusion.

Attack surface

Reachable remotely over the network via HTTP requests to the html/log or services/system/info.html URI. The CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required.

Exploitation

Public exploit code exists in Exploit-DB (45384) and a GitHub exploit suite, and EPSS is 0.56401 (99th percentile), indicating a high likelihood of exploitation. The CVE is not listed in CISA KEV, so there is no confirmed in-the-wild exploitation record in this dataset.

What to do

• Upgrade CirCarLife Scada to version 4.3 or later, which the description states fixes the issue.
• If upgrade is not possible, restrict network access to the SCADA web interface using firewall rules or a management VLAN.
• Require authentication and authorization for the html/log and services/system/info.html endpoints.
• Remove or disable the exposed log and system information pages if they are not operationally required.
• Monitor for direct requests to these URIs and treat them as suspicious.

Detection

• Search web server or proxy logs for requests to /html/log and /services/system/info.html.
• Alert on unauthenticated access to administrative or diagnostic SCADA endpoints.
• Review network traffic for direct HTTP requests to CirCarLife Scada management paths from unexpected sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.