Vulnerability Report

CVE-2018-10628

RCE

Title: Aveva Intouch 2017 RCE

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2018-10628.

CWE Category CWE-119
Published Date Jul 24, 2018
Modified Date Nov 21, 2024
Exploit Status Not Found
Score 9.8 CVSS v3.0
Exploit Probability (EPSS)
5.43%

Vulnerability Summary

CVE-2018-10628: AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.

Impacted Vendors

A
aveva 2

Reference Links

http://www.securityfocus.com/bid/104864 https://ics-cert.us-cert.gov/advisories/ICSA-18-200-02 https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec127%28003%29.pdf http://www.securityfocus.com/bid/104864 https://ics-cert.us-cert.gov/advisories/ICSA-18-200-02 https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec127%28003%29.pdf
CVSS v3.0
Source Entity [email protected]
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0
Source Entity [email protected]
Severity HIGH
7.5
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2018-10628 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.