Login Request a demo
High severity · published Jun 7, 2019
CVE-2019-6532
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource…
7.8
CVSS
3.8%
EPSS
No
On KEV
Description
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Control Fpwin Pro · Panasonic
through 7.3.0.0 · source: NVD
Affected product
CF
Control Fpwin Pro
Panasonic
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6532
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6532
Third Party Advisory
http://www.securityfocus.com/bid/108683
Mailing List
https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-566/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-568/
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-570/
More from Control Fpwin Pro
7.8
CVE-2023-28730
A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project…
7.8
CVE-2023-28729
A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project…
7.8
CVE-2023-28728
A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution when opening specially crafted project…
7.8
CVE-2019-6530
Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows, which may lead to…