CVE-2018-19005

HIGH

Cscape <= 9.80.75.3 SP3 - Remote Code Execution via Crafted POC File

Title source: llm
STIX 2.1

Description

Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing specially crafted POC files lacking user input validation. This may allow an attacker to read confidential information and remotely execute arbitrary code.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/106275
Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-354-01

Scores

CVSS v3 7.8
EPSS 0.0167
EPSS Percentile 74.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (2)
hornerautomation/cscape 9.80.75.3 (4 CPE variants)
hornerautomation/cscape < 9.80.75.3
Published Dec 20, 2018
Tracked Since Feb 18, 2026