CVE-2018-8840

State: Published
Severity: Not scored
Published: Apr 18, 2018
Updated: Sep 16, 2024
Reserved: Mar 20, 2018

Description

A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.

Scores

The record has no CVSS score.

Weaknesses

CWE-121 STACK-BASED BUFFER OVERFLOW CWE-121

Affected Products

Product	Versions
Schneider Electric InduSoft Web Studio and InTouch Machine EditionICS-CERT	InduSoft Web Studio v8.1 and prior versions, and InTouch Machine Edition 2017 v8.1 and prior versions.Affected

References

103949vdb-entry
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/
https://www.tenable.com/security/research/tra-2018-07
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.