High severity · published Aug 13, 2018
CVE-2018-10598
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to crash due to lacking user input…
8.1
CVSS
3.5%
EPSS
No
On KEV
Description
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to crash due to lacking user input validation for processing project files. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
CNCSoft with ScreenEditor · ICS-CERT
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 · source: vendor
CN
Cncsoft · Deltaww
through 1.00.83 · source: NVD
SC
Screeneditor · Deltaww
1.00.54 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10598
Third Party Advisory
http://www.securityfocus.com/bid/105032
Mitigation
https://ics-cert.us-cert.gov/advisories/ICSA-18-219-01
More from CNCSoft with ScreenEditor
8.8
CVE-2018-10636
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking…