CVE-2018-18993: omron cx-one Stack-based Buffer Overflow

Vulnerability summary

CVE-2018-18993 is a high (CVSS 7.8) Stack-based Buffer Overflow vulnerability in omron cx-one. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities.

Timeline

1. 04-12-2018
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior). When processing project files, the application allows input data to exceed the buffer. An attacker could use a specially crafted project file to overflow the buffer and execute code under the privileges of the application.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.