10

CVE-2018-17916

Exploit

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. If InduSoft Web Studio remote communication security was not enabled, or a password was left blank, a remote user could send a carefully crafted packet to invoke an arbitrary process, with potential for code to be executed. The code would be executed under the privileges of the InduSoft Web Studio or InTouch Edge HMI runtime and could lead to a compromise of the InduSoft Web Studio or InTouch Edge HMI server machine.

Data is provided by the National Vulnerability Database (NVD)
Aveva ≫ Indusoft Web Studio Version6.1 Updatesp5
Aveva ≫ Indusoft Web Studio Version6.1 Updatesp6_p3
Aveva ≫ Indusoft Web Studio Version7.1
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp1
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp2
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p1
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p2
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p3
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p4
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p5
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p6
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p7
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p8
Aveva ≫ Indusoft Web Studio Version7.1 Updatesp3_p9
Aveva ≫ Indusoft Web Studio Version8.0
Aveva ≫ Indusoft Web Studio Version8.0 Updatep1
Aveva ≫ Indusoft Web Studio Version8.0 Updatep2
Aveva ≫ Indusoft Web Studio Version8.0 Updatep3
Aveva ≫ Indusoft Web Studio Version8.0 Updatesp1
Aveva ≫ Indusoft Web Studio Version8.0 Updatesp1_p1
Aveva ≫ Indusoft Web Studio Version8.0 Updatesp2
Aveva ≫ Indusoft Web Studio Version8.0 Updatesp2_p1
Aveva ≫ Indusoft Web Studio Version8.1
Aveva ≫ Indusoft Web Studio Version8.1 Updatep1
Aveva ≫ Indusoft Web Studio Version8.1 Updatesp1
Aveva ≫ Indusoft Web Studio Version8.1 Updatesp1_p1
Aveva ≫ Edge Version8.1 Update-
Aveva ≫ Edge Version8.1 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 9.84% 0.927
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-121 Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://ics-cert.us-cert.gov/advisories/ICSA-18-305-01
Third Party Advisory
US Government Resource
Mitigation