CVE-2018-10620 Memory corruption in InTouch Machine Edition
Remote attackers can execute arbitrary code via crafted packets exploiting a stack-based buffer overflow in AVEVA SCADA systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10620?
CVE-2018-10620 is a critical memory corruption vulnerability in AVEVA Software, LLC InTouch Machine Edition, published on 19 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.
Which versions are affected by CVE-2018-10620?
It affects 2 products.
Products include Aveva Indusoft Web Studio, Aveva Intouch Machine 2017.
How do I fix CVE-2018-10620?
No fix has been published for CVE-2018-10620 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-10620 being exploited?
There is no known exploitation of CVE-2018-10620 in the wild and no public exploit code.
Other vulnerabilities in AVEVA Software, LLC InTouch Machine Edition
- CVE-2019-6543 Missing authorization in AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update
- CVE-2019-6545 Code injection in AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update
Sources
Also known as GHSA-92qr-7f7r-87vw.