PT-2018-1634 · Wecon Technology · Pi Studio+1

Mat Powell + 2 · Published 2018-10-02 · Updated 2020-08-28 · CVE-2018-14818

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior

Description The issue is caused by a stack-based buffer overflow in PI Studio, which may allow a remote attacker to execute arbitrary code.

Recommendations For WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior, update to a version later than 4.1.9 to resolve the issue. For WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior, update to a version later than 4.2.34 to resolve the issue. As a temporary workaround, consider restricting access to the PI Studio to minimize the risk of exploitation.

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2018-01193

CVE-2018-14818

ZDI-18-1109

Affected Products

Pi Studio

Pi Studio Hmi

References · 5

• https://bdu.fstec.ru/vul/2018-01193 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14818 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1109 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 · Note