High severity · published Nov 5, 2018
CVE-2018-17909
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may allow an attacker to…
7.8
CVSS
1.6%
EPSS
No
On KEV
Description
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed memory, which may allow an attacker to execute code under the context of the application.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
Cx-supervisor · Omron
through 3.4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-17909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-17909
Third Party Advisory
http://www.securityfocus.com/bid/105691
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01
More from Cx-supervisor
8.8
CVE-2019-18251
In Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS
8.8
CVE-2018-19017
Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior)
8.8
CVE-2018-19011
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file
7.8
CVE-2018-17913
A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an attacker to execute code in the context…
7.8
CVE-2018-17905
When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may occur within a specific object