PT-2019-18144 · Panasonic · Panasonic Fpwin Pro

Published 2019-06-07 · Updated 2020-10-06 · CVE-2019-6532

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Panasonic FPWIN Pro version 7.3.0.0 and prior

Description The issue allows an attacker-created project file to be loaded by an authenticated user, triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution.

Recommendations For Panasonic FPWIN Pro version 7.3.0.0 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2019-6532

ZDI-19-566

ZDI-19-568

ZDI-19-570

Affected Products

Panasonic Fpwin Pro

References · 7

• https://zerodayinitiative.com/advisories/ZDI-19-566 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-568 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-6532 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-570 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6532 · Vendor Advisory
• http://securityfocus.com/bid/108683 · Note