PT-2018-14261 · Omron · Cx-Supervisor

Published 2018-10-17 · Updated 2019-10-09 · CVE-2018-17909

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omron CX-Supervisor versions 3.4.1.0 and prior

Description The issue arises when processing project files, where the application fails to check if it is referencing freed memory. This may allow an attacker to execute code under the context of the application. The vulnerability is related to the parsing of certain file types, including sr3, SCS, and PAG files.

Recommendations For Omron CX-Supervisor versions 3.4.1.0 and prior, update to a version that includes a fix for the use-after-free vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2018-17909

ZDI-18-1279

ZDI-18-1281

ZDI-18-1282

ZDI-18-1283

ZDI-18-1284

ZDI-18-1446

Affected Products

Cx-Supervisor

References · 10

• https://zerodayinitiative.com/advisories/ZDI-18-1283 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1281 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17909 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-1284 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1282 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1446 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-17909 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1279 · Security Note
• http://securityfocus.com/bid/105691 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01 · Note