Buffer overflow in Deltaww Cncsoft
CVE-2018-10636
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking user input validation before copying data from project files onto the stack. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.095 (95.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.095 · newest: 0.095 · change: 0.000
Affected products
- Deltaww Cncsoft
- Deltaww Screeneditor — versions 1.00.54
- Ics-Cert Cncsoft With Screeneditor — versions CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54
Weakness classification (CWE)
References
- ics-cert.us-cert.gov/advisories/ICSA-18-219-01 (US Government Resource, Third Party Advisory, Mitigation)
- www.securityfocus.com/bid/105032 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-10636?
- CVE-2018-10636 is a high-severity vulnerability in Deltaww Cncsoft, classified under Stack-based Buffer Overflow. CVSS score: 8.8/10. Published 2018-08-13.
- How severe is CVE-2018-10636?
- High severity. CVSS v3 base score is 8.8 out of 10.