CVE-2018-18993

HIGH

CX-One < 4.42, CX-Programmer < 9.66, CX-Server < 5.0.23 - Stack-based Buffer Overflow via Project File Processing

Title source: llm

Description

Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.

References (2)

Core 2

Core References

Third Party Advisory, US Government Resource x_refsource_misc

https://ics-cert.us-cert.gov/advisories/ICSA-18-338-01

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/106106

Scores

CVSS v3 7.8

EPSS 0.0175

EPSS Percentile 75.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-121 CWE-787

Status published

Products (3)

omron/cx-one < 4.42

omron/cx-programmer < 9.66

omron/cx-server < 5.0.23

Published Dec 04, 2018

Tracked Since Feb 18, 2026