CVE-2018-7530: Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and…

Description

Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and prior, CX-Protocol versions 1.992 and prior, CX-Programmer versions 9.65 and prior, CX-Server versions 5.0.22 and prior, Network Configurator versions 3.63 and prior, and Switch Box Utility versions 1.68 and prior, may allow the pointer to call an incorrect object resulting in an access of resource using incompatible type condition.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 26% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CX

Cx-flnet · Omron

through 1.00 · source: NVD

CX

Cx-one · Omron

through 4.42 · source: NVD

CX

Cx-programmer · Omron

through 9.65 · source: NVD

CX

Cx-protocol · Omron

through 1.992 · source: NVD

CX

Cx-server · Omron

through 5.0.22 · source: NVD

NC

Network Configurator · Omron

through 3.63 · source: NVD

SB

Switch Box Utility · Omron

through 1.68 · source: NVD