CVE-2018-10628: Buffer Overflow
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-10628?
CVE-2018-10628 is a vulnerability in AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 that allows an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator, leading to remote code execution.
What is the severity of CVE-2018-10628?
CVE-2018-10628 is categorized as critical with a severity score of 9.8.
How can an unauthenticated user exploit CVE-2018-10628?
An unauthenticated user can exploit CVE-2018-10628 by sending a specially crafted packet that overflows the buffer on a locale not using a dot floating point separator, potentially allowing for remote code execution.
Which versions of AVEVA InTouch are affected by CVE-2018-10628?
CVE-2018-10628 affects AVEVA InTouch 2014 R2, InTouch 2014 R2 SP1, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2.
How can I fix CVE-2018-10628?
To fix CVE-2018-10628, it is recommended to apply the necessary patches or updates provided by AVEVA to the affected software versions.