CVE-2018-10623
This may cause improper restriction of operations within the bounds of the memory buffer, allow remote code execution, alter the intended control flow, allow reading of sensitive information, or cause the application to crash.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer, allow remote code execution, alter the intended control flow, allow reading of sensitive information, or cause the application to crash.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.53% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- deltaww/delta industrial automation dopsoft
- Source
- ics-cert@hq.dhs.gov
References
- http://www.securityfocus.com/bid/104375Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01Third Party Advisory, US Government Resource
- http://www.securityfocus.com/bid/104375Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.