CVE-2018-10620
9.8
CRITICAL · CVSS 3.1 · EPSS 4.2% (pctl 91)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 4.2% — more likely to be exploited than 91% of all CVEs |
| Weakness | CWE-121 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2018-07-19 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| aveva | indusoft web studio |
| aveva | intouch machine 2017 |
References
- http://www.securityfocus.com/bid/104870
- https://ics-cert.us-cert.gov/advisories/ICSA-18-200-01
- https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec128%28002%29.pdf
- https://www.tenable.com/security/research/tra-2018-19
- http://www.securityfocus.com/bid/104870
- https://ics-cert.us-cert.gov/advisories/ICSA-18-200-01
- https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec128%28002%29.pdf
- https://www.tenable.com/security/research/tra-2018-19
→ the Explorer · watch your stack · NVD