High ICSA-18-290-01 4 CVEs

Omron CX-Supervisor (Update A)

Published Oct 17, 2018 · Updated Jan 31, 2019 · Revision 2

Vendor: Omron Product: CX-Supervisor

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute code under the context of the application, corrupt objects, and force the application to read a value outside of an array.

Vulnerabilities 4

Unscored —

CVE-2018-17905

When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, mem…

Omron CX-Supervisor ICS / OT

Nov 5, 2018
Unscored —

CVE-2018-17907

When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offs…

Omron CX-Supervisor ICS / OT

Nov 5, 2018
Unscored —

CVE-2018-17909

When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it i…

Omron CX-Supervisor ICS / OT

Nov 5, 2018
Unscored —

CVE-2018-17913

A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, …

Omron CX-Supervisor ICS / OT

Nov 5, 2018

Revision history

2019-01-31 #2
ICSA-18-290-01 Omron CX-Supervisor (Update A)
2018-10-17 #1
ICSA-18-290-01 Omron CX-Supervisor

References

ICS Advisory ICSA-18-290-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-290-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B