PT-2018-14276 · Gigasoft+2 · Gigasoft Charting Package+2

Limingzheng · Published 2018-10-10 · Updated 2019-10-09 · CVE-2018-17925

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GE iFIX versions 2.0 through 5.8

Description The issue is related to an Unsafe ActiveX Control Marked Safe For Scripting in a third-party ActiveX object provided by Gigasoft. This vulnerability may be exposed when the Gigasoft charting package is used independently outside the iFIX product. The method that impacts Internet Explorer is not exposed in the iFIX product, and the core functionality of the iFIX product is not known to be impacted.

Recommendations For GE iFIX versions 2.0 through 5.8, consider restricting the use of the Gigasoft charting package outside the iFIX product to minimize the risk of exploitation. As a temporary workaround, avoid using the independent Gigasoft charting package until a patch or fix is available.

Fix

Weakness Enumeration

CWE-623

Related Identifiers

CVE-2018-17925

Affected Products

Ge Ifix

Gigasoft Charting Package

Internet Explorer

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-17925 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17925 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01 · Note
• http://securityfocus.com/bid/105540 · Note