CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
AI Score
Confidence
High
EPSS
Percentile
40.2%
CVSS v3 5.3
ATTENTION: Low skill level to exploit
Vendor: Omron
Equipment: CX-Supervisor
Vulnerabilities: Stack-based Buffer Overflow, Use After Free, Access of Uninitialized Pointer, Double Free, Out-of-bounds Write, Untrusted Pointer Dereference, Heap-based Buffer Overflow.
This updated advisory is a follow-up to the original advisory titled ICSA-18-072-01 Omron CX-Supervisor that was published March 13, 2018, on the NCCIC/ICS-CERT website.
Successful exploitation of these vulnerabilities could allow remote code execution.
The following versions of CX-Supervisor are affected:
--------- Begin Update A Part 1 of 2 --------
--------- End Update A Part 1 of 2 ----------
4.2.1 STACK-BASED BUFFER OVERFLOW CWE-121
Parsing malformed project files may cause a stack-based buffer overflow.
CVE-2018-7513 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
4.2.2 USE AFTER FREE CWE-416
Use after free vulnerabilities can be exploited when CX Supervisor parses a specially crafted project file.
CVE-2018-7521 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
4.2.3 ACCESS OF UNINITIALIZED POINTER CWE-824
Access of uninitialized pointer vulnerabilities can be exploited when CX Supervisor indirectly calls an initialized pointer when parsing malformed packets.
CVE-2018-7515 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
4.2.4 DOUBLE FREE CWE-415
Parsing malformed project files may cause a double free vulnerability.
CVE-2018-7523 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
4.2.5 OUT-OF-BOUNDS WRITE CWE-787
Parsing malformed project files may cause an out of bounds vulnerability.
CVE-2018-7517 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
4.2.6 UNTRUSTED POINTER DEREFERENCE CWE-822
Processing a malformed packet by a certain executable may cause an untrusted pointer dereference vulnerability.
CVE-2018-7525 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
4.2.7 HEAP-BASED BUFFER OVERFLOW CWE-122
Parsing malformed project files may cause a heap-based buffer overflow.
CVE-2018-7519 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
--------- Begin Update A Part 2 of 2 --------
Esteban Ruiz (mr_me) of Source Incite and rgod working with Trend Microβs Zero Day Initiative reported these vulnerabilities to NCCIC.
--------- End Update A Part 2 of 2 ----------
Omron has released Version 3.4.1 of CX-Supervisor to address the reported vulnerabilities. Users can download the latest version of CX-Supervisor at the following location:
https://www.myomron.com/index.php?action=kb&article=1707
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web site. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT web site in the Technical Information Paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
NCCIC also recommends that users take the following measures to protect themselves from social engineering attacks:
No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7513
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7515
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7517
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7519
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7521
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7523
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-7525
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-18-072-01
cwe.mitre.org/data/definitions/121.html
cwe.mitre.org/data/definitions/122.html
cwe.mitre.org/data/definitions/415.html
cwe.mitre.org/data/definitions/416.html
cwe.mitre.org/data/definitions/787.html
cwe.mitre.org/data/definitions/822.html
cwe.mitre.org/data/definitions/824.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=Omron%20CX-Supervisor%20%28Update%20A%29+https://www.cisa.gov/news-events/ics-advisories/icsa-18-072-01
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-18-072-01&title=Omron%20CX-Supervisor%20%28Update%20A%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-18-072-01
www.myomron.com/index.php?action=kb&article=1707
www.oig.dhs.gov/
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Omron%20CX-Supervisor%20%28Update%20A%29&body=www.cisa.gov/news-events/ics-advisories/icsa-18-072-01
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
AI Score
Confidence
High
EPSS
Percentile
40.2%