PT-2018-10007 · Delta Electronics · Dopsoft

Published 2018-06-05 · Updated 2019-10-09 · CVE-2018-10617

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Delta Electronics Delta Industrial Automation DOPSoft versions 4.00.04 and prior

Description The issue concerns a heap-based buffer overflow that occurs when a value larger than the buffer is read from a .dpa file into a fixed-length heap buffer. This may lead to remote code execution or cause the application to crash.

Recommendations For versions 4.00.04 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

CVE-2018-10617

ZDI-18-536

Affected Products

Dopsoft

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-10617 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-536 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10617 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01 · Note
• http://securityfocus.com/bid/104375 · Note