High severity · published Oct 11, 2018
CVE-2018-17929
In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted…
7.8
CVSS
1.8%
EPSS
No
On KEV
Description
In Delta Industrial Automation TPEditor, TPEditor Versions 1.90 and prior, multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files lacking user input validation before copying data from project files onto the stack and may allow an attacker to remotely execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TP
Tpeditor · Deltaww
through 1.90 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-17929
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-17929
Third Party Advisory
http://www.securityfocus.com/bid/105682
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-284-03
More from Tpeditor
9.8
CVE-2018-8871
In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulnerability, which may allow remote code…
7.8
CVE-2021-33007
A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file
7.8
CVE-2020-27288
An untrusted pointer dereference has been identified in the way TPEditor(v1.98 and prior) processes project files, allowing an attacker to craft a special project file that may…
7.8
CVE-2020-27284
TPEditor (v1.98 and prior) is vulnerable to two out-of-bounds write instances in the way it processes project files, allowing an attacker to craft a special project file that may…
7.8
CVE-2020-16227
Delta Electronics TPEditor Versions 1.97 and prior