Buffer overflow in Deltaww Cncsoft
CVE-2018-10636
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking user input validation before copying data from project files onto the stack. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
Vulnerability class: Buffer Overflow
EPSS: 0.095 (94.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Deltaww Cncsoft
- Deltaww Screeneditor — versions 1.00.54
- Ics-cert Cncsoft With Screeneditor — versions CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC, Mitigation)
- ics-cert@hq.dhs.gov (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-10636?
- CVE-2018-10636 is a high-severity vulnerability in Deltaww Cncsoft, classified under Stack-based Buffer Overflow. CVSS score: 8.8/10. Published 2018-08-13.
- How severe is CVE-2018-10636?
- High severity. CVSS v3 base score is 8.8 out of 10.