Lucene search

IcscertCVE-2018-17909

HistoryNov 05, 2018 - 11:29 p.m.

CVE-2018-17909

2018-11-0523:29:00

CWE-416

icscert

web.nvd.nist.gov

omron

cx-supervisor

cve-2018-17909

memory vulnerability

code execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may allow an attacker to execute code under the context of the application.

Affected configurations

Nvd

Node

omroncx-supervisorRange≤3.4.1.0

VendorProductVersionCPE
omroncx-supervisor*cpe:2.3:a:omron:cx-supervisor:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
omron	cx-supervisor	*	cpe:2.3:a:omron:cx-supervisor::::::::

CNA Affected

[
  {
    "product": "CX-Supervisor",
    "vendor": "Omron",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 3.4.1.0 and prior."
      }
    ]
  }
]

References

www.securityfocus.com/bid/105691

ics-cert.us-cert.gov/advisories/ICSA-18-290-01

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

44.9%

JSON

Related for CVE-2018-17909