High severity · published Aug 13, 2018
CVE-2018-10636
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking…
8.8
CVSS
9.4%
EPSS
No
On KEV
Description
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking user input validation before copying data from project files onto the stack. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.4% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
CNCSoft with ScreenEditor · ICS-CERT
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 · source: vendor
CN
Cncsoft · Deltaww
through 1.00.83 · source: NVD
SC
Screeneditor · Deltaww
1.00.54 · source: NVD
Affected product
CW
CNCSoft with ScreenEditor
ICS-CERT
More from CNCSoft with ScreenEditor
8.1
CVE-2018-10598
CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to crash due to lacking user input…