CVE-2018-10620: aveva software, llc indusoft web studio Stack-based Buffer Overflow
Vulnerability summary
CVE-2018-10620 is a critical (CVSS 9.8) Stack-based Buffer Overflow vulnerability in aveva software, llc indusoft web studio. EPSS estimates a 4.20% chance of exploitation in the next 30 days, higher than 90.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-07-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.20%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
-0.05 pp
From 4.25% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (tenable.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Aveva2 products
- indusoft_web_studio8.1 | 8.1:sp1
- intouch_machine_20178.1 | 8.1:sp1
Aveva software, llc2 products
- indusoft web studiov8.1 and v8.1SP1
- intouch machine editionv2017 8.1 and v2017 8.1 SP1
2 vendors · 4 products
References
4 links- ics-cert.us-cert.gov/advisories/ICSA-18-200-01X Refsource MISCThird Party AdvisoryUS Government Resource