Out-of-bounds Read in Deltaww Cncsoft
CVE-2018-10598
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to crash due to lacking user input validation for processing project files. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
Vulnerability class: Buffer Overflow
EPSS: 0.035 (88.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H.
Affected products
- Deltaww Cncsoft
- Deltaww Screeneditor — versions 1.00.54
- Ics-cert Cncsoft With Screeneditor — versions CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-10598?
- CVE-2018-10598 is a high-severity vulnerability in Deltaww Cncsoft, classified under Out-of-bounds Read. CVSS score: 8.1/10. Published 2018-08-13.
- How severe is CVE-2018-10598?
- High severity. CVSS v3 base score is 8.1 out of 10.