PT-2019-18164 · Omron · Omron Cx-Programmer+1

Esteban Ruiz + 1 · Publicado 2019-04-10 · Atualizado 2019-04-15 · CVE-2019-6556

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Omron CX-Programmer versions 9.70 and prior Common Components versions January 2019 and prior

Description The issue arises when the application processes project files, specifically due to a failure in checking references to freed memory. This can be exploited by an attacker using a specially crafted project file, potentially leading to the execution of code under the application's privileges.

Recommendations For Omron CX-Programmer versions 9.70 and prior, consider disabling the project file processing feature until a patch is available. For Common Components versions January 2019 and prior, restrict access to project file parsing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2019-6556

ZDI-19-344

Produtos afetados

Common Components

Omron Cx-Programmer

Referências · 4

• https://zerodayinitiative.com/advisories/ZDI-19-344 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-19-094-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-6556 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-6556 · Aviso do Fabricante