Lucene search

IcscertCVE-2018-7530

HistoryApr 17, 2018 - 7:29 p.m.

CVE-2018-7530

2018-04-1719:29:00

CWE-843

CWE-118

icscert

web.nvd.nist.gov

cve-2018-7530

omron cx-one

parsing issue

resource access

vulnerability

nvd

security

cx-flnet

cx-protocol

cx-programmer

cx-server

network configurator

switch box utility

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

50.5%

JSON

Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may allow the pointer to call an incorrect object resulting in an access of resource using incompatible type condition.

Affected configurations

Nvd

Node

omroncx-flnetRange≤1.00

omroncx-oneRange≤4.42

omroncx-programmerRange≤9.65

omroncx-protocolRange≤1.992

omroncx-serverRange≤5.0.22

omronnetwork_configuratorRange≤3.63

omronswitch_box_utilityRange≤1.68

VendorProductVersionCPE
omroncx-flnet*cpe:2.3:a:omron:cx-flnet:*:*:*:*:*:*:*:*
omroncx-one*cpe:2.3:a:omron:cx-one:*:*:*:*:*:*:*:*
omroncx-programmer*cpe:2.3:a:omron:cx-programmer:*:*:*:*:*:*:*:*
omroncx-protocol*cpe:2.3:a:omron:cx-protocol:*:*:*:*:*:*:*:*
omroncx-server*cpe:2.3:a:omron:cx-server:*:*:*:*:*:*:*:*
omronnetwork_configurator*cpe:2.3:a:omron:network_configurator:*:*:*:*:*:*:*:*
omronswitch_box_utility*cpe:2.3:a:omron:switch_box_utility:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
omron	cx-flnet	*	cpe:2.3:a:omron:cx-flnet::::::::
omron	cx-one	*	cpe:2.3:a:omron:cx-one::::::::
omron	cx-programmer	*	cpe:2.3:a:omron:cx-programmer::::::::
omron	cx-protocol	*	cpe:2.3:a:omron:cx-protocol::::::::
omron	cx-server	*	cpe:2.3:a:omron:cx-server::::::::
omron	network_configurator	*	cpe:2.3:a:omron:network_configurator::::::::
omron	switch_box_utility	*	cpe:2.3:a:omron:switch_box_utility::::::::

CNA Affected

[
  {
    "product": "Omron CX-One",
    "vendor": "ICS-CERT",
    "versions": [
      {
        "status": "affected",
        "version": "The following versions of CX-One are affected: CX-One Versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior."
      }
    ]
  }
]

References

ics-cert.us-cert.gov/advisories/ICSA-18-100-02

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

50.5%

JSON

Related for CVE-2018-7530