CVE-2019-6539: ics-cert wecon levistudiou Heap-based Buffer Overflow

Vulnerability summary

CVE-2019-6539 is a high (CVSS 9.3) Heap-based Buffer Overflow vulnerability in ics-cert wecon levistudiou. EPSS estimates a 2.11% chance of exploitation in the next 30 days, higher than 81.6% of scored vulnerabilities.

Timeline

1. 13-02-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.