PT-2016-5980 · Panasonic · Panasonic Fpwin Pro

Steven Seeley · Published 2016-05-11 · Updated 2016-11-28 · CVE-2016-4497

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Panasonic FPWIN Pro versions 5.x through 7.x before 7.130

Description The issue allows local users to cause a denial of service or possibly have unspecified other impact. It is related to "type confusion" and can be leveraged via certain vectors. There is also a mention of a Type Confusion Remote Code Execution Vulnerability, but details about real-world incidents or the estimated number of potentially affected devices are not provided.

Recommendations For versions 5.x through 7.x before 7.130, update to version 7.130 or later to resolve the issue. As a temporary workaround, consider restricting access to the DeleteAndCreateSysRegDecls And SaveSysRegDeclsDatabaseIdsToTheSysRegDeclInfoMap function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-4497

ZDI-16-334

Affected Products

Panasonic Fpwin Pro

References · 5

• https://zerodayinitiative.com/advisories/ZDI-16-334 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-4497 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-16-334 · Note
• http://securityfocus.com/bid/90523 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-131-01 · Note