AVEVA InduSoft Web Studio / InTouch Edge HMI UniSoft.dll wcscpy() Stack Overflow

2018-10-3100:00:00

www.tenable.com

The AVEVA InduSoft Web Studio (IWS) or InTouch Edge HMI (formerly InTouch Machine Edition) running on the remote host is affected by a remote code execution vulnerability due to a stack overflow condition when handling certain command messages to the TCPIP server listening on the default port 1234. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to execute arbitrary code.

Binary data scada_aveva_iws_iteh_unisoft_stack_overflow.nbin

VendorProductVersionCPE
avevaintouch_edge_hmix-cpe:/a:aveva:intouch_edge_hmi
schneider_electricwonderware_intouch_machine_editionx-cpe:/a:schneider_electric:wonderware_intouch_machine_edition
schneider_electricindusoft_web_studiocpe:/a:schneider_electric:indusoft_web_studio

Vendor	Product	CPE
aveva	intouch_edge_hmi	x-cpe:/a:aveva:intouch_edge_hmi
schneider_electric	wonderware_intouch_machine_edition	x-cpe:/a:schneider_electric:wonderware_intouch_machine_edition
schneider_electric	indusoft_web_studio	cpe:/a:schneider_electric:indusoft_web_studio

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17916

www.nessus.org/u?a158baaf

ics-cert.us-cert.gov/advisories/ICSA-18-305-01

JSON