CVE ID | CVE-2018-14818 |
CVSS SCORE | 9.3, AV:N/AC:M/Au:N/C:C/I:C/A:C |
AFFECTED VENDORS |
Wecon |
AFFECTED PRODUCTS |
PIStudio |
VULNERABILITY DETAILS |
The specific flaw exists within the handling of hsc files. When parsing the TextContent element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of an administrator.
|
ADDITIONAL DETAILS |
Wecon has issued an update to correct this vulnerability. More details can be found at:
https://us-cert.cisa.gov/ics/advisories/ICSA-18-277-01
05/18/18 - ZDI sent the report to ICS-CERT -- Mitigation: |
DISCLOSURE TIMELINE |
|
CREDIT | Natnael Samson(Natti) |