10

CVE-2018-17916

Exploit
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. If InduSoft Web Studio remote communication security was not enabled, or a password was left blank, a remote user could send a carefully crafted packet to invoke an arbitrary process, with potential for code to be executed. The code would be executed under the privileges of the InduSoft Web Studio or InTouch Edge HMI runtime and could lead to a compromise of the InduSoft Web Studio or InTouch Edge HMI server machine.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Aveva ≫ Indusoft Web Studio Version 6.1 Update sp5
Aveva ≫ Indusoft Web Studio Version 6.1 Update sp6_p3
Aveva ≫ Indusoft Web Studio Version 7.1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp2
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p1
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p2
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p3
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p4
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p5
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p6
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p7
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p8
Aveva ≫ Indusoft Web Studio Version 7.1 Update sp3_p9
Aveva ≫ Indusoft Web Studio Version 8.0
Aveva ≫ Indusoft Web Studio Version 8.0 Update p1
Aveva ≫ Indusoft Web Studio Version 8.0 Update p2
Aveva ≫ Indusoft Web Studio Version 8.0 Update p3
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp1
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp1_p1
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp2
Aveva ≫ Indusoft Web Studio Version 8.0 Update sp2_p1
Aveva ≫ Indusoft Web Studio Version 8.1
Aveva ≫ Indusoft Web Studio Version 8.1 Update p1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp1
Aveva ≫ Indusoft Web Studio Version 8.1 Update sp1_p1
Aveva ≫ Edge Version 8.1 Update -
Aveva ≫ Edge Version 8.1 Update sp1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.73% 0.884
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01
Third Party Advisory
US Government Resource
Mitigation
https://www.tenable.com/security/research/tra-2018-34
Third Party Advisory
Exploit