PT-2024-38031 · Unknown · Control Fpwin Pro

Michael Heinzl · Published 2024-08-21 · Updated 2024-08-25 · CVE-2024-7013

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Control FPWIN Pro versions 7.7.2.0 and all previous versions

Description A stack-based buffer overflow in Control FPWIN Pro may allow attackers to execute arbitrary code via a specially crafted project file. This issue can be exploited by attackers to gain remote code execution.

Recommendations For Control FPWIN Pro versions 7.7.2.0 and all previous versions, patch immediately and validate project files to prevent exploitation. As a temporary workaround, consider restricting access to project files until a patch is applied.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2024-7013

Affected Products

Control Fpwin Pro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-7013 · Security Note
• https://t.me/cvenotify/91458 · Telegram Post
• https://twitter.com/cracbot/status/1827949147699450153 · Twitter Post
• https://industry.panasonic.com/jp/ja/products/fasys/plc/software/fpwinpro7 · Note
• https://industry.panasonic.eu/products/automation-devices-solutions/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro · Note
• https://twitter.com/oktsec/status/1826170937680490898 · Twitter Post
• https://twitter.com/CVEnew/status/1826280554863403282 · Twitter Post
• https://t.me/cvedetector/3734 · Telegram Post