PT-2018-1635 · Wecon Technology · Pi Studio+1

Published 2018-10-02 · Updated 2019-12-30 · CVE-2018-14810

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior

Description The issue is caused by a buffer overflow vulnerability, which allows an attacker to execute arbitrary code remotely. This is due to the parsing of files and passing of invalidated user data to an unsafe method call, potentially allowing code execution in the context of an administrator.

Recommendations For WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior, update to a version later than 4.1.9 to resolve the issue. For WECON Technology Co., Ltd. PI Studio versions 4.2.34 and prior, update to a version later than 4.2.34 to resolve the issue. As a temporary workaround, consider restricting access to the file parsing functionality to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2018-01194

CVE-2018-14810

ZDI-18-1107

ZDI-19-1032

ZDI-19-449

ZDI-19-450

Affected Products

Pi Studio

Pi Studio Hmi

References · 8

• https://zerodayinitiative.com/advisories/ZDI-18-1107 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-449 · Security Note
• https://bdu.fstec.ru/vul/2018-01194 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14810 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-450 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-1032 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 · Note