Details of VAR-201809-0087

ID

VAR-201809-0087

CVE

CVE-2018-10602

TITLE

(0Day) Wecon LeviStudioU usermanage GroupList ID Stack-based Buffer Overflow Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-18-824

DESCRIPTION

WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple stack-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Wecon LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of UMP files. When parsing the EventSet WordAddr element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of Administrator. WECON LeviStudio is a set of human interface programming software from WECON, China

Trust: 11.07

sources: NVD: CVE-2018-10602 // ZDI: ZDI-18-824 // ZDI: ZDI-18-818 // ZDI: ZDI-18-846 // ZDI: ZDI-18-848 // ZDI: ZDI-18-798 // ZDI: ZDI-18-856 // ZDI: ZDI-18-868 // ZDI: ZDI-18-858 // ZDI: ZDI-18-788 // ZDI: ZDI-18-836 // ZDI: ZDI-18-838 // ZDI: ZDI-18-819 // ZDI: ZDI-18-850 // ZDI: ZDI-18-805 // ZDI: ZDI-18-828 // CNVD: CNVD-2018-14455 // IVD: e2f727b1-39ab-11e9-8ff0-000c29342cb1

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: e2f727b1-39ab-11e9-8ff0-000c29342cb1 // CNVD: CNVD-2018-14455

AFFECTED PRODUCTS

vendor:	wecon	model:	levistudiou	scope:	-	version:	-	Trust: 10.5
vendor:	we con	model:	levistudiou	scope:	eq	version:	1.8.44	Trust: 1.6
vendor:	we con	model:	levistudiou	scope:	eq	version:	1.8.29	Trust: 1.6
vendor:	wecon	model:	levistudiou	scope:	eq	version:	1.8.29	Trust: 0.6
vendor:	wecon	model:	levistudiou	scope:	eq	version:	1.8.44	Trust: 0.6
vendor:	levistudiou	model:	-	scope:	eq	version:	1.8.29	Trust: 0.2
vendor:	levistudiou	model:	-	scope:	eq	version:	1.8.44	Trust: 0.2

sources: IVD: e2f727b1-39ab-11e9-8ff0-000c29342cb1 // ZDI: ZDI-18-824 // ZDI: ZDI-18-828 // ZDI: ZDI-18-805 // ZDI: ZDI-18-850 // ZDI: ZDI-18-819 // ZDI: ZDI-18-838 // ZDI: ZDI-18-836 // ZDI: ZDI-18-788 // ZDI: ZDI-18-858 // ZDI: ZDI-18-868 // ZDI: ZDI-18-856 // ZDI: ZDI-18-798 // ZDI: ZDI-18-848 // ZDI: ZDI-18-846 // ZDI: ZDI-18-818 // CNVD: CNVD-2018-14455 // CNNVD: CNNVD-201808-310 // NVD: CVE-2018-10602

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2018-10602
value:	HIGH
Trust: 10.5
nvd@nist.gov:	CVE-2018-10602
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2018-14455
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201808-310
value:	HIGH
Trust: 0.6
IVD:	e2f727b1-39ab-11e9-8ff0-000c29342cb1
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2018-10602
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 11.5
CNVD:	CNVD-2018-14455
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	e2f727b1-39ab-11e9-8ff0-000c29342cb1
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2018-10602
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0

PROBLEMTYPE DATA

problemtype:	CWE-121	Trust: 1.0
problemtype:	CWE-787	Trust: 1.0

sources: NVD: CVE-2018-10602

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201808-310

TYPE

Buffer error

Trust: 0.8

sources: IVD: e2f727b1-39ab-11e9-8ff0-000c29342cb1 // CNNVD: CNNVD-201808-310

PATCH

title:	Wecon has issued an update to correct this vulnerability. This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline.03/07/18 - ZDI disclosed the report to ICS-CERT03/12/18 - ICS-CERT assigned ICS‑VU‑031741 and notified ZDI07/06/18 - ZDI inquired the status of ICS‑VU‑03174107/09/18 - ICS-CERT replied that they would advise the vendor07/19/18 - ZDI advised ICS-CERT of the intended 0-day date: 07/26/2018-- Mitigation:Given the nature of the vulnerability the only salient mitigation strategy is to restrict interaction with the application to trusted files.	url:	https://ics-cert.us-cert.gov/advisories/ICSA-18-212-03	Trust: 9.8
title:	WECON (wei control) LeviStudioU stack heap buffer overflow vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/136079	Trust: 0.6

sources: ZDI: ZDI-18-824 // ZDI: ZDI-18-828 // ZDI: ZDI-18-805 // ZDI: ZDI-18-850 // ZDI: ZDI-18-819 // ZDI: ZDI-18-838 // ZDI: ZDI-18-836 // ZDI: ZDI-18-788 // ZDI: ZDI-18-858 // ZDI: ZDI-18-856 // ZDI: ZDI-18-798 // ZDI: ZDI-18-848 // ZDI: ZDI-18-846 // ZDI: ZDI-18-818 // CNVD: CNVD-2018-14455

EXTERNAL IDS

db:	NVD	id:	CVE-2018-10602	Trust: 12.9
db:	ICS CERT	id:	ICSA-18-212-03	Trust: 2.2
db:	BID	id:	104935	Trust: 1.6
db:	CNVD	id:	CNVD-2018-14455	Trust: 0.8
db:	CNNVD	id:	CNNVD-201808-310	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-5905	Trust: 0.7
db:	ZDI	id:	ZDI-18-824	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5909	Trust: 0.7
db:	ZDI	id:	ZDI-18-828	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5870	Trust: 0.7
db:	ZDI	id:	ZDI-18-805	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5931	Trust: 0.7
db:	ZDI	id:	ZDI-18-850	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5900	Trust: 0.7
db:	ZDI	id:	ZDI-18-819	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5919	Trust: 0.7
db:	ZDI	id:	ZDI-18-838	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5917	Trust: 0.7
db:	ZDI	id:	ZDI-18-836	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5791	Trust: 0.7
db:	ZDI	id:	ZDI-18-788	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5939	Trust: 0.7
db:	ZDI	id:	ZDI-18-858	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5947	Trust: 0.7
db:	ZDI	id:	ZDI-18-868	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5937	Trust: 0.7
db:	ZDI	id:	ZDI-18-856	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5802	Trust: 0.7
db:	ZDI	id:	ZDI-18-798	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5929	Trust: 0.7
db:	ZDI	id:	ZDI-18-848	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5927	Trust: 0.7
db:	ZDI	id:	ZDI-18-846	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-5899	Trust: 0.7
db:	ZDI	id:	ZDI-18-818	Trust: 0.7
db:	IVD	id:	E2F727B1-39AB-11E9-8FF0-000C29342CB1	Trust: 0.2

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-18-212-03	Trust: 12.0
url:	http://www.securityfocus.com/bid/104935	Trust: 1.6

CREDITS

Mat Powell of Trend Micro Zero Day Initiative

Trust: 9.8

sources: ZDI: ZDI-18-824 // ZDI: ZDI-18-828 // ZDI: ZDI-18-805 // ZDI: ZDI-18-850 // ZDI: ZDI-18-819 // ZDI: ZDI-18-838 // ZDI: ZDI-18-836 // ZDI: ZDI-18-788 // ZDI: ZDI-18-858 // ZDI: ZDI-18-868 // ZDI: ZDI-18-856 // ZDI: ZDI-18-848 // ZDI: ZDI-18-846 // ZDI: ZDI-18-818

SOURCES

db:	IVD	id:	e2f727b1-39ab-11e9-8ff0-000c29342cb1
db:	ZDI	id:	ZDI-18-824
db:	ZDI	id:	ZDI-18-828
db:	ZDI	id:	ZDI-18-805
db:	ZDI	id:	ZDI-18-850
db:	ZDI	id:	ZDI-18-819
db:	ZDI	id:	ZDI-18-838
db:	ZDI	id:	ZDI-18-836
db:	ZDI	id:	ZDI-18-788
db:	ZDI	id:	ZDI-18-858
db:	ZDI	id:	ZDI-18-868
db:	ZDI	id:	ZDI-18-856
db:	ZDI	id:	ZDI-18-798
db:	ZDI	id:	ZDI-18-848
db:	ZDI	id:	ZDI-18-846
db:	ZDI	id:	ZDI-18-818
db:	CNVD	id:	CNVD-2018-14455
db:	CNNVD	id:	CNNVD-201808-310
db:	NVD	id:	CVE-2018-10602

LAST UPDATE DATE

2025-03-29T23:38:52.502000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-18-824	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-828	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-805	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-850	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-819	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-838	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-836	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-788	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-858	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-868	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-856	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-798	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-848	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-846	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-818	date:	2018-08-02T00:00:00
db:	CNVD	id:	CNVD-2018-14455	date:	2018-08-02T00:00:00
db:	CNNVD	id:	CNNVD-201808-310	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-10602	date:	2024-11-21T03:41:38.663

SOURCES RELEASE DATE

db:	IVD	id:	e2f727b1-39ab-11e9-8ff0-000c29342cb1	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-824	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-828	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-805	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-850	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-819	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-838	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-836	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-788	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-858	date:	2018-08-02T00:00:00
db:	ZDI	id:	ZDI-18-868	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-856	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-798	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-848	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-846	date:	2018-07-26T00:00:00
db:	ZDI	id:	ZDI-18-818	date:	2018-08-02T00:00:00
db:	CNVD	id:	CNVD-2018-14455	date:	2018-08-02T00:00:00
db:	CNNVD	id:	CNNVD-201808-310	date:	2018-08-13T00:00:00
db:	NVD	id:	CVE-2018-10602	date:	2018-09-26T18:29:00.323