var-201805-1147
Vulnerability from variot
WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3. Delta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "wplsoft",
"scope": null,
"trust": 3.5,
"vendor": "delta industrial automation",
"version": null
},
{
"_id": null,
"model": "industrial automation wplsoft",
"scope": null,
"trust": 1.2,
"vendor": "delta",
"version": null
},
{
"_id": null,
"model": "wplsoft",
"scope": "lte",
"trust": 1.0,
"vendor": "deltaww",
"version": "2.45.0"
},
{
"_id": null,
"model": "electronics wplsoft",
"scope": "lte",
"trust": 0.8,
"vendor": "delta",
"version": "\u003c=2.45.0"
},
{
"_id": null,
"model": "industrial automation wplsoft",
"scope": "eq",
"trust": 0.8,
"vendor": "delta",
"version": "*"
},
{
"_id": null,
"model": "wplsoft",
"scope": "lte",
"trust": 0.8,
"vendor": "delta",
"version": "2.45.0"
},
{
"_id": null,
"model": "wplsoft",
"scope": "eq",
"trust": 0.6,
"vendor": "deltaww",
"version": "2.45.0"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.45.0"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.42.11"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "eq",
"trust": 0.3,
"vendor": "delta",
"version": "2.0"
},
{
"_id": null,
"model": "electronics inc wplsoft",
"scope": "ne",
"trust": 0.3,
"vendor": "delta",
"version": "2.46.0"
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:delta_electronics:wplsoft",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
}
]
},
"credits": {
"_id": null,
"data": "axt",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
}
],
"trust": 3.5
},
"cve": "CVE-2018-7507",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2018-7507",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 3.3,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-7507",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 1.4,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 4.9,
"id": "CVE-2018-7507",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-22821",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-22824",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.7,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-03768",
"impactScore": 9.5,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.7,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"impactScore": 9.5,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:C/A:C",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2018-7507",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2018-7507",
"trust": 2.1,
"value": "MEDIUM"
},
{
"author": "ZDI",
"id": "CVE-2018-7507",
"trust": 1.4,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2018-7507",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-7507",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2017-22821",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2017-22824",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-03768",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201803-768",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2018-7507",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"description": {
"_id": null,
"data": "WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability\n2. A heap-based buffer-overflow vulnerability\n3. \nDelta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-7507"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
}
],
"trust": 7.65
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2018-7507",
"trust": 7.1
},
{
"db": "ICS CERT",
"id": "ICSA-18-058-02",
"trust": 3.4
},
{
"db": "BID",
"id": "103179",
"trust": 2.0
},
{
"db": "ZDI",
"id": "ZDI-17-705",
"trust": 1.3
},
{
"db": "ZDI",
"id": "ZDI-17-702",
"trust": 1.3
},
{
"db": "CNVD",
"id": "CNVD-2017-22821",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2017-22824",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2018-03768",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4442",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4436",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-703",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4441",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-704",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4439",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-699",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4440",
"trust": 0.7
},
{
"db": "IVD",
"id": "E3004F6E-39AB-11E9-A5A2-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E3000150-39AB-11E9-9CA4-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E4E1F909-5D49-466D-AC98-CDBBB329C50D",
"trust": 0.2
},
{
"db": "IVD",
"id": "E8DD53BE-8850-484E-AB8A-BC308C7F1C64",
"trust": 0.2
},
{
"db": "IVD",
"id": "E300285E-39AB-11E9-83A1-000C29342CB1",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2018-7507",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"id": "VAR-201805-1147",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
}
],
"trust": 3.7166666666666663
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 2.8
}
],
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1"
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d"
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64"
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
}
]
},
"last_update_date": "2024-11-29T22:41:28.661000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Delta Industrial Automation has issued an update to correct this vulnerability. This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.02/01/17 - ZDI disclosed reports to ICS-CERT02/07/17 - ICS-CERT provided ZDI with an ICS-VU # ICS-VU-97456803/16/17 - ICS-CERT asked ZDI questions about reproduction03/27/17 - ICS-CERT asked ZDI again some questions about reproduction06/07/17 - ICS-CERT offered ZDI a pre-release patch to test06/07/17 - ZDI replied that we cannot do the testing for the vendor07/20/17 - ZDI sent a mail to ICS-CERT asking the status07/26/17 - ICS-CERT advised that the vendor has a new version they believe addressed the reports (though to ZDI knowledge, no advisory was released)08/02/17 - ZDI advised ICS-CERT that our finder indicated that the vulnerabilities are still present08/11/17 - ZDI wrote ICS-CERT to indicate the intention to move these reports to 0-day on 8/24-- Mitigation:Given the nature of the vulnerability the only salient mitigation strategy is to restrict interaction with the application to trusted files.",
"trust": 3.5,
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-058-02"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.deltaww.com/"
},
{
"title": "Patch for Delta Industrial Automation WPLSoft dvp File Buffer Buffer Overflow Vulnerability (CNVD-2017-228214)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/143677"
},
{
"title": "Delta Industrial Automation WPLSoft dvp file heap buffer overflow vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/143683"
},
{
"title": "Patch for Delta Electronics WPLSoft Heap Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/119165"
},
{
"title": "Delta Electronics WPLSoft Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79354"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
},
{
"problemtype": "CWE-122",
"trust": 1.0
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 7.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-058-02"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/103179"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7507"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-7507"
},
{
"trust": 0.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-702/"
},
{
"trust": 0.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-705/"
},
{
"trust": 0.3,
"url": "http://www.deltaww.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-699"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
},
{
"db": "CNVD",
"id": "CNVD-2017-22821"
},
{
"db": "CNVD",
"id": "CNVD-2017-22824"
},
{
"db": "CNVD",
"id": "CNVD-2018-03768"
},
{
"db": "VULMON",
"id": "CVE-2018-7507"
},
{
"db": "BID",
"id": "103179"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
},
{
"db": "NVD",
"id": "CVE-2018-7507"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"ident": null
},
{
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"ident": null
},
{
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"ident": null
},
{
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"ident": null
},
{
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-705",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-703",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-704",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-699",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-17-702",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2017-22821",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2017-22824",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2018-03768",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2018-7507",
"ident": null
},
{
"db": "BID",
"id": "103179",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2018-7507",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2018-02-28T00:00:00",
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e3000150-39ab-11e9-9ca4-000c29342cb1",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e4e1f909-5d49-466d-ac98-cdbbb329c50d",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e8dd53be-8850-484e-ab8a-bc308c7f1c64",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e300285e-39ab-11e9-83a1-000c29342cb1",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-705",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-703",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-704",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-699",
"ident": null
},
{
"date": "2017-08-24T00:00:00",
"db": "ZDI",
"id": "ZDI-17-702",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22821",
"ident": null
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22824",
"ident": null
},
{
"date": "2018-02-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03768",
"ident": null
},
{
"date": "2018-05-04T00:00:00",
"db": "VULMON",
"id": "CVE-2018-7507",
"ident": null
},
{
"date": "2018-02-27T00:00:00",
"db": "BID",
"id": "103179",
"ident": null
},
{
"date": "2018-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"ident": null
},
{
"date": "2018-03-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-768",
"ident": null
},
{
"date": "2018-05-04T19:29:00.313000",
"db": "NVD",
"id": "CVE-2018-7507",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-705",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-703",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-704",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-699",
"ident": null
},
{
"date": "2018-03-28T00:00:00",
"db": "ZDI",
"id": "ZDI-17-702",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22821",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22824",
"ident": null
},
{
"date": "2018-11-05T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-03768",
"ident": null
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-7507",
"ident": null
},
{
"date": "2018-02-27T00:00:00",
"db": "BID",
"id": "103179",
"ident": null
},
{
"date": "2018-06-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-004571",
"ident": null
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201803-768",
"ident": null
},
{
"date": "2024-11-21T04:12:15.890000",
"db": "NVD",
"id": "CVE-2018-7507",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "(0Day) Delta Industrial Automation WPLSoft dvp File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-705"
},
{
"db": "ZDI",
"id": "ZDI-17-703"
},
{
"db": "ZDI",
"id": "ZDI-17-704"
},
{
"db": "ZDI",
"id": "ZDI-17-702"
}
],
"trust": 2.8
},
"type": {
"_id": null,
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "e3004f6e-39ab-11e9-a5a2-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201803-768"
}
],
"trust": 0.8
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.