Lucene search

IcscertCVE-2018-7527

HistoryApr 26, 2018 - 8:29 p.m.

CVE-2018-7527

2018-04-2620:29:00

CWE-119

CWE-121

icscert

web.nvd.nist.gov

buffer overflow

levistudio

hmi editor

cve-2018-7527

security vulnerability

wecon levistudiou

pi studio hmi project programmer

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.9%

JSON

A buffer overflow can be triggered in LeviStudio HMI Editor, Version 1.10 part of Wecon LeviStudioU 1.8.29, and PI Studio HMI Project Programmer, Build: November 11, 2017 and prior by opening a specially crafted file.

Affected configurations

Nvd

Node

we-conlevistudio_hmi_editorMatch1.10

Node

we-conlevistudiouRange≤1.8.29

Node

we-conpi_studio_hmi_project_programmerRange≤2017-11-11

VendorProductVersionCPE
we-conlevistudio_hmi_editor1.10cpe:2.3:a:we-con:levistudio_hmi_editor:1.10:*:*:*:*:*:*:*
we-conlevistudiou*cpe:2.3:a:we-con:levistudiou:*:*:*:*:*:*:*:*
we-conpi_studio_hmi_project_programmer*cpe:2.3:a:we-con:pi_studio_hmi_project_programmer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
we-con	levistudio_hmi_editor	1.10	cpe:2.3:a:we-con:levistudio_hmi_editor:1.10:::::::*
we-con	levistudiou	*	cpe:2.3:a:we-con:levistudiou::::::::
we-con	pi_studio_hmi_project_programmer	*	cpe:2.3:a:we-con:pi_studio_hmi_project_programmer::::::::

CNA Affected

[
  {
    "product": "LeviStudio HMI Editor",
    "vendor": "WECON Technology Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Version 1.10 part of Wecon LeviStudioU 1.8.29 and prior"
      }
    ]
  },
  {
    "product": "PI Studio HMI Project Programmer",
    "vendor": "WECON Technology Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Build: November 11, 2017 and prior"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104016

ics-cert.us-cert.gov/advisories/ICSA-18-116-02

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

5.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

35.9%

JSON

Related for CVE-2018-7527