Sign-up

ID

VAR-201804-1656


CVE

CVE-2018-7530


TITLE

Omron CX-One Code execution hole

Trust: 0.8

sources: IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // CNVD: CNVD-2018-07873

DESCRIPTION

Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may allow the pointer to call an incorrect object resulting in an access of resource using incompatible type condition. Provided by OMRON Corporation CX-One The following applications contain several vulnerabilities: * Stack-based buffer overflow (CWE-121) - CVE-2018-7514 Stack-based buffer overflows can occur due to processing of specially crafted project files. * Accessing resources using inappropriate types ( Mixing of molds ) (CWE-843) - CVE-2018-7530 Due to the processing of a specially crafted project file, access to the outside of the memory area may occur by calling an object with an incorrect type. * Heap-based buffer overflow (CWE-122) - CVE-2018-8834 A heap-based buffer overflow can occur due to the processing of a specially crafted project file.A remote attacker could execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OMRON CX-One. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of PSW files. When parsing a crafted file, the process does not properly validate user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code under the context of the current process. The Omron CX-One is an integrated toolkit from Omron, Japan (Omron) that includes networking, PT, frequency converters, temperature controllers, and PLC programming software. CX-FLnet, etc. are all integrated applications. There are security vulnerabilities in multiple softwares in Omron CX-One 4.42 and earlier. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3

Trust: 3.33

sources: NVD: CVE-2018-7530 // JVNDB: JVNDB-2018-002441 // ZDI: ZDI-18-283 // CNVD: CNVD-2018-07873 // BID: 103970 // IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // VULHUB: VHN-137562

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // CNVD: CNVD-2018-07873

AFFECTED PRODUCTS

vendor:omronmodel:cx-onescope:lteversion:4.42

Trust: 1.0

vendor:omronmodel:cx-serverscope:lteversion:5.0.22

Trust: 1.0

vendor:omronmodel:network configuratorscope:lteversion:3.63

Trust: 1.0

vendor:omronmodel:cx-protocolscope:lteversion:1.992

Trust: 1.0

vendor:omronmodel:cx-flnetscope:lteversion:1.00

Trust: 1.0

vendor:omronmodel:cx-programmerscope:lteversion:9.65

Trust: 1.0

vendor:omronmodel:switch box utilityscope:lteversion:1.68

Trust: 1.0

vendor:omronmodel:switch box utilityscope:eqversion:1.68

Trust: 0.9

vendor:omronmodel:network configuratorscope:eqversion:3.63

Trust: 0.9

vendor:omronmodel:cx-serverscope:eqversion:5.0.22

Trust: 0.9

vendor:omronmodel:cx-protocolscope:eqversion:1.992

Trust: 0.9

vendor:omronmodel:cx-programmerscope:eqversion:9.65

Trust: 0.9

vendor:omronmodel:cx-onescope:eqversion:4.42

Trust: 0.9

vendor:omronmodel:cx-flnetscope:eqversion:1.00

Trust: 0.9

vendor:omronmodel:cx-flnetscope:lteversion:version 1.00

Trust: 0.8

vendor:omronmodel:cx-programmerscope:lteversion:version 9.65

Trust: 0.8

vendor:omronmodel:cx-protocolscope:lteversion:version 1.992

Trust: 0.8

vendor:omronmodel:cx-serverscope:lteversion:version 5.0.22

Trust: 0.8

vendor:omronmodel:network configuratorscope:lteversion:version 3.63

Trust: 0.8

vendor:omronmodel:switch box utilityscope:lteversion:version 1.68

Trust: 0.8

vendor:omronmodel:cx-onescope: - version: -

Trust: 0.7

vendor:omronmodel:cx-flnetscope: - version: -

Trust: 0.6

vendor:omronmodel:cx-protocolscope: - version: -

Trust: 0.6

vendor:omronmodel:cx-programmerscope: - version: -

Trust: 0.6

vendor:omronmodel:cx-serverscope: - version: -

Trust: 0.6

vendor:omronmodel:network configuratorscope: - version: -

Trust: 0.6

vendor:omronmodel:switch box utilityscope: - version: -

Trust: 0.6

vendor:omronmodel:cx-onescope:lteversion:<=4.42

Trust: 0.6

vendor:omronmodel:switch box utilityscope:neversion:1.69

Trust: 0.3

vendor:omronmodel:network configuratorscope:neversion:3.64

Trust: 0.3

vendor:omronmodel:cx-serverscope:neversion:5.0.23

Trust: 0.3

vendor:omronmodel:cx-protocolscope:neversion:1.993

Trust: 0.3

vendor:omronmodel:cx-programmerscope:neversion:9.66

Trust: 0.3

vendor:omronmodel:cx-flnetscope:neversion:1.10

Trust: 0.3

vendor:cx flnetmodel: - scope:eqversion:*

Trust: 0.2

vendor:cx onemodel: - scope:eqversion:*

Trust: 0.2

vendor:cx programmermodel: - scope:eqversion:*

Trust: 0.2

vendor:cx protocolmodel: - scope:eqversion:*

Trust: 0.2

vendor:cx servermodel: - scope:eqversion:*

Trust: 0.2

vendor:network configuratormodel: - scope:eqversion:*

Trust: 0.2

vendor:switch box utilitymodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // ZDI: ZDI-18-283 // CNVD: CNVD-2018-07873 // BID: 103970 // JVNDB: JVNDB-2018-002441 // CNNVD: CNNVD-201804-791 // NVD: CVE-2018-7530

CVSS

SEVERITY

CVSSV2

CVSSV3

JPCERT/CC: JVNDB-2018-002441
value: MEDIUM

Trust: 2.4

nvd@nist.gov: CVE-2018-7530
value: HIGH

Trust: 1.0

ZDI: CVE-2018-7530
value: MEDIUM

Trust: 0.7

CNVD: CNVD-2018-07873
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201804-791
value: HIGH

Trust: 0.6

IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1
value: HIGH

Trust: 0.2

VULHUB: VHN-137562
value: MEDIUM

Trust: 0.1

JPCERT/CC: JVNDB-2018-002441
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 2.4

nvd@nist.gov: CVE-2018-7530
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

ZDI: CVE-2018-7530
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.7

CNVD: CNVD-2018-07873
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-137562
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

JPCERT/CC: JVNDB-2018-002441
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 2.4

nvd@nist.gov: CVE-2018-7530
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.0

sources: IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // ZDI: ZDI-18-283 // CNVD: CNVD-2018-07873 // VULHUB: VHN-137562 // JVNDB: JVNDB-2018-002441 // JVNDB: JVNDB-2018-002441 // JVNDB: JVNDB-2018-002441 // CNNVD: CNNVD-201804-791 // NVD: CVE-2018-7530

PROBLEMTYPE DATA

problemtype:CWE-843

Trust: 1.8

problemtype:CWE-118

Trust: 1.1

problemtype:CWE-121

Trust: 0.8

problemtype:CWE-122

Trust: 0.8

sources: VULHUB: VHN-137562 // JVNDB: JVNDB-2018-002441 // NVD: CVE-2018-7530

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201804-791

TYPE

Code problem

Trust: 0.8

sources: IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // CNNVD: CNNVD-201804-791

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-002441

PATCH
title:Network Configurator の更新内容: Ver.3.64 : CX-Oneオートアップデート（V4向け_2018年4月）url:https://www.fa.omron.co.jp/product/tool/26/cxone/j4_doc.html#network_configurator
Trust: 0.8
title:SwitchBoxUtility の更新内容: Ver.1.69 : CX-Oneオートアップデート（V4向け_2018年4月）url:https://www.fa.omron.co.jp/product/tool/26/cxone/j4_doc.html#switchboxutility
Trust: 0.8
title:共通モジュール の更新内容: − : CX-Oneオートアップデート（V4向け_2018年4月）url:https://www.fa.omron.co.jp/product/tool/26/cxone/j4_doc.html#common_module
Trust: 0.8
title:CX-FLnet の更新内容: Ver.1.10 : CX-Oneオートアップデート（V4向け_2018年4月）url:https://www.fa.omron.co.jp/product/tool/26/cxone/j4_doc.html#cx_flnet
Trust: 0.8
title:CX-One バージョンアップ プログラム ダウンロードurl:https://www.fa.omron.co.jp/product/tool/26/cxone/one1.html
Trust: 0.8
title:CX-Programmer の更新内容: Ver.9.66 : CX-Oneオートアップデート（V4向け_2018年4月）url:https://www.fa.omron.co.jp/product/tool/26/cxone/j4_doc.html#cx_programmer
Trust: 0.8
title:CX-Protocol の更新内容: Ver.1.993 : CX-Oneオートアップデート（V4向け_2018年4月）url:https://www.fa.omron.co.jp/product/tool/26/cxone/j4_doc.html#cx_protocol
Trust: 0.8
title:OMRON has issued an update to correct this vulnerability.url:https://ics-cert.us-cert.gov/advisories/ICSA-18-100-02
Trust: 0.7
title:Omron CX-One code execution hole patchurl:https://www.cnvd.org.cn/patchInfo/show/126153
Trust: 0.6
title:Omron CX-One Fixes for multiple software security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80160
Trust: 0.6
sources:
            
            
            ZDI: ZDI-18-283 // 
            
            
            
            CNVD: CNVD-2018-07873 // 
            
            
            
            JVNDB: JVNDB-2018-002441 // 
            
            
            
            CNNVD: CNNVD-201804-791

EXTERNAL IDS
db:NVDid:CVE-2018-7530
Trust: 4.3
db:ICS CERTid:ICSA-18-100-02
Trust: 3.4
db:CNVDid:CNVD-2018-07873
Trust: 0.8
db:CNNVDid:CNNVD-201804-791
Trust: 0.8
db:JVNid:JVNVU95484528
Trust: 0.8
db:JVNDBid:JVNDB-2018-002441
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-5404
Trust: 0.7
db:ZDIid:ZDI-18-283
Trust: 0.7
db:BIDid:103970
Trust: 0.3
db:IVDid:E2EBDD12-39AB-11E9-8F48-000C29342CB1
Trust: 0.2
db:VULHUBid:VHN-137562
Trust: 0.1
sources:
            
            
            IVD: e2ebdd12-39ab-11e9-8f48-000c29342cb1 // 
            
            
            
            ZDI: ZDI-18-283 // 
            
            
            
            CNVD: CNVD-2018-07873 // 
            
            
            
            VULHUB: VHN-137562 // 
            
            
            
            BID: 103970 // 
            
            
            
            JVNDB: JVNDB-2018-002441 // 
            
            
            
            CNNVD: CNNVD-201804-791 // 
            
            
            
            NVD: CVE-2018-7530

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-100-02
Trust: 4.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7514
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7530
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-8834
Trust: 0.8
url:http://jvn.jp/vu/jvnvu95484528/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-7514
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-7530
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-8834
Trust: 0.8
url:https://industrial.omron.eu/
Trust: 0.3
sources:
            
            
            ZDI: ZDI-18-283 // 
            
            
            
            CNVD: CNVD-2018-07873 // 
            
            
            
            VULHUB: VHN-137562 // 
            
            
            
            BID: 103970 // 
            
            
            
            JVNDB: JVNDB-2018-002441 // 
            
            
            
            CNNVD: CNNVD-201804-791 // 
            
            
            
            NVD: CVE-2018-7530

CREDITS
rgod
Trust: 0.7
sources:
            
            
            ZDI: ZDI-18-283

SOURCES
db:IVDid:e2ebdd12-39ab-11e9-8f48-000c29342cb1
db:ZDIid:ZDI-18-283
db:CNVDid:CNVD-2018-07873
db:VULHUBid:VHN-137562
db:BIDid:103970
db:JVNDBid:JVNDB-2018-002441
db:CNNVDid:CNNVD-201804-791
db:NVDid:CVE-2018-7530

LAST UPDATE DATE
2024-11-23T22:17:35.160000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-18-283date:2018-04-11T00:00:00
db:CNVDid:CNVD-2018-07873date:2018-04-19T00:00:00
db:VULHUBid:VHN-137562date:2019-10-09T00:00:00
db:BIDid:103970date:2018-04-10T00:00:00
db:JVNDBid:JVNDB-2018-002441date:2018-08-22T00:00:00
db:CNNVDid:CNNVD-201804-791date:2019-10-17T00:00:00
db:NVDid:CVE-2018-7530date:2024-11-21T04:12:18.397

SOURCES RELEASE DATE
db:IVDid:e2ebdd12-39ab-11e9-8f48-000c29342cb1date:2018-04-19T00:00:00
db:ZDIid:ZDI-18-283date:2018-04-11T00:00:00
db:CNVDid:CNVD-2018-07873date:2018-04-19T00:00:00
db:VULHUBid:VHN-137562date:2018-04-17T00:00:00
db:BIDid:103970date:2018-04-10T00:00:00
db:JVNDBid:JVNDB-2018-002441date:2018-04-12T00:00:00
db:CNNVDid:CNNVD-201804-791date:2018-04-18T00:00:00
db:NVDid:CVE-2018-7530date:2018-04-17T19:29:00.387