PT-2018-1637 · Wecon Technology · Pi Studio Hmi+1

Published 2018-10-02 · Updated 2019-10-09 · CVE-2018-14814

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WECON Technology PI Studio HMI versions 4.1.9 and prior PI Studio versions 4.2.34 and prior

Description The issue is caused by a lack of proper validation of user-supplied data, which may result in a read past the end of an allocated object. This can potentially allow a remote attacker to access protected information.

Recommendations For WECON Technology PI Studio HMI versions 4.1.9 and prior, update to a version later than 4.1.9 to resolve the issue. For PI Studio versions 4.2.34 and prior, update to a version later than 4.2.34 to resolve the issue. As a temporary workaround, consider restricting access to user-supplied data to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2018-01196

CVE-2018-14814

ZDI-18-1108

Affected Products

Pi Studio

Pi Studio Hmi

References · 5

• https://bdu.fstec.ru/vul/2018-01196 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-14814 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1108 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14814 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01 · Note