Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
267 vulnerabilities by fujielectric
CVE-2024-11789 (GCVE-0-2024-11789)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:34 – Updated: 2024-11-29 17:09
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24448.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-29 16:43 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
6.2.3.0
|
|
| fujielectric | monitouch_v-sft |
Affected:
6.2.3.0
cpe:2.3:a:fujielectric:monitouch_v-sft:6.2.3.0:*:*:*:*:*:*:* |
Date Public
2024-11-27 20:57
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:monitouch_v-sft:6.2.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "monitouch_v-sft",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "6.2.3.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11789",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T17:09:49.168Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "6.2.3.0"
}
]
}
],
"dateAssigned": "2024-11-26T16:01:28.497Z",
"datePublic": "2024-11-27T20:57:48.619Z",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24448."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:34:14.031Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1615",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1615/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11789",
"datePublished": "2024-11-27T23:34:14.031Z",
"dateReserved": "2024-11-26T16:01:28.470Z",
"dateUpdated": "2024-11-29T17:09:49.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11787 (GCVE-0-2024-11787)
Vulnerability from cvelistv5 – Published: 2024-11-27 23:34 – Updated: 2024-11-29 17:09
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24413.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-29 16:43 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
6.2.3.0
|
|
| fujielectric | monitouch_v-sft |
Affected:
6.2.3.0
cpe:2.3:a:fujielectric:monitouch_v-sft:6.2.3.0:*:*:*:*:*:*:* |
Date Public
2024-11-27 20:57
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:monitouch_v-sft:6.2.3.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "monitouch_v-sft",
"vendor": "fujielectric",
"versions": [
{
"status": "affected",
"version": "6.2.3.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11787",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T16:43:24.101858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T17:09:49.282Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"status": "affected",
"version": "6.2.3.0"
}
]
}
],
"dateAssigned": "2024-11-26T16:01:18.991Z",
"datePublic": "2024-11-27T20:57:25.081Z",
"descriptions": [
{
"lang": "en",
"value": "Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of V10 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-24413."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-27T23:34:08.859Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-24-1614",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1614/"
}
],
"source": {
"lang": "en",
"value": "kimiya"
},
"title": "Fuji Electric Monitouch V-SFT V10 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2024-11787",
"datePublished": "2024-11-27T23:34:08.859Z",
"dateReserved": "2024-11-26T16:01:18.939Z",
"dateUpdated": "2024-11-29T17:09:49.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37022 (GCVE-0-2024-37022)
Vulnerability from cvelistv5 – Published: 2024-06-13 17:25 – Updated: 2024-08-02 03:43
VLAI
EPSS
VEX
Title
Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write
Summary
Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 18:48 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Tellus Lite V-Simulator |
Affected:
0 , < 4.0.20.0
(custom)
|
|
| fujielectric | tellus_lite_v-simulator |
Affected:
0 , < 4.0.20.0
(custom)
cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:* |
Date Public
2024-06-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tellus_lite_v-simulator",
"vendor": "fujielectric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37022",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T18:48:57.921592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T18:51:44.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.589Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tellus Lite V-Simulator",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-06-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code.\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T17:25:49.609Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFuji Electric recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d\"\u003ev4.0.20.0\u003c/a\u003e.\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update to v4.0.20.0 https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d ."
}
],
"source": {
"advisory": "ICSA-24-165-14",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-37022",
"datePublished": "2024-06-13T17:25:49.609Z",
"dateReserved": "2024-06-06T17:39:34.310Z",
"dateUpdated": "2024-08-02T03:43:50.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37029 (GCVE-0-2024-37029)
Vulnerability from cvelistv5 – Published: 2024-06-13 17:23 – Updated: 2024-08-02 03:43
VLAI
EPSS
VEX
Title
Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow
Summary
Fuji Electric Tellus Lite V-Simulator
is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 18:55 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Tellus Lite V-Simulator |
Affected:
0 , < 4.0.20.0
(custom)
|
|
| fujielectric | tellus_lite_v-simulator |
Affected:
0 , < 4.0.20.0
(custom)
cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:* |
Date Public
2024-06-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tellus_lite_v-simulator",
"vendor": "fujielectric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37029",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T18:55:22.773512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T18:51:36.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.796Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tellus Lite V-Simulator",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-06-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric Tellus Lite V-Simulator \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.\n\n"
}
],
"value": "Fuji Electric Tellus Lite V-Simulator \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T17:23:40.591Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFuji Electric recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d\"\u003ev4.0.20.0\u003c/a\u003e.\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update to v4.0.20.0 https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d ."
}
],
"source": {
"advisory": "ICSA-24-165-14",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-37029",
"datePublished": "2024-06-13T17:23:40.591Z",
"dateReserved": "2024-06-06T17:39:34.317Z",
"dateUpdated": "2024-08-02T03:43:50.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5597 (GCVE-0-2024-5597)
Vulnerability from cvelistv5 – Published: 2024-06-10 16:53 – Updated: 2024-08-01 21:18
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT Type Confusion
Summary
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-10 20:11 UTC
CWE
- CWE-843 - Type Confusion
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
0 , < 6.2.3.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-10T20:11:14.382101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T20:12:13.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric Monitouch V-SFT\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eis vulnerable to a type confusion, which could cause a crash or code execution.\u003c/span\u003e\n\n"
}
],
"value": "Fuji Electric Monitouch V-SFT\u00a0is vulnerable to a type confusion, which could cause a crash or code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Type Confusion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T16:53:50.147Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric recommends users update the product to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd\"\u003eMonitouch V-SFT v6.2.3.0\u003c/a\u003e.\n\n\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update the product to Monitouch V-SFT v6.2.3.0 https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd ."
}
],
"source": {
"advisory": "ICSA-24-151-02",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Monitouch V-SFT Type Confusion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5597",
"datePublished": "2024-06-10T16:53:50.147Z",
"dateReserved": "2024-06-03T13:32:22.404Z",
"dateUpdated": "2024-08-01T21:18:06.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-34171 (GCVE-0-2024-34171)
Vulnerability from cvelistv5 – Published: 2024-05-30 19:55 – Updated: 2024-08-02 02:51
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow
Summary
Fuji Electric Monitouch V-SFT
is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-25 18:32 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
0 , < 6.2.3.0
(custom)
|
|
| fujielectric | monitouch_v-sft |
Affected:
0 , < 6.2.3.0
(custom)
cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "monitouch_v-sft",
"vendor": "fujielectric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T18:32:35.936779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T18:33:50.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:51:09.599Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nFuji Electric Monitouch V-SFT \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.\n\n"
}
],
"value": "Fuji Electric Monitouch V-SFT \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-30T19:55:23.835Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nFuji Electric recommends users update the product to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd\"\u003eMonitouch V-SFT v6.2.3.0\u003c/a\u003e.\n\n\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update the product to Monitouch V-SFT v6.2.3.0 https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd ."
}
],
"source": {
"advisory": "ICSA-24-151-02",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-34171",
"datePublished": "2024-05-30T19:55:23.835Z",
"dateReserved": "2024-05-20T14:11:06.275Z",
"dateUpdated": "2024-08-02T02:51:09.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5271 (GCVE-0-2024-5271)
Vulnerability from cvelistv5 – Published: 2024-05-30 19:53 – Updated: 2025-07-24 14:42
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')
Summary
Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a
type confusion, which could result in arbitrary code execution.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-24 14:42 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
0 , < 6.2.3.0
(custom)
|
|
| fujielectric | monitouch_v-sft |
Affected:
0 , ≤ 6.2.3.0
(custom)
cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "monitouch_v-sft",
"vendor": "fujielectric",
"versions": [
{
"lessThanOrEqual": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-24T14:42:08.803828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-24T14:42:21.260Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:11.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a\n type confusion, which could result in arbitrary code execution."
}
],
"value": "Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a\n type confusion, which could result in arbitrary code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-18T17:45:36.547Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric recommends users update the product to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd\"\u003eMonitouch V-SFT v6.2.3.0\u003c/a\u003e.\n\n\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update the product to Monitouch V-SFT v6.2.3.0 https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd ."
}
],
"source": {
"advisory": "ICSA-24-151-02",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5271",
"datePublished": "2024-05-30T19:53:30.195Z",
"dateReserved": "2024-05-23T14:36:06.242Z",
"dateUpdated": "2025-07-24T14:42:21.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-202205-2013
Vulnerability from variot - Updated: 2024-06-15 23:14Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code. Fuji Electric Alpha7 PC Loader
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202205-2013",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "alpha7 pc loader",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "*"
},
{
"model": "alpha7 pc loader",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "alpha7 pc loader",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "alpha7 pc loader firmware all s"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:alpha7_pc_loader_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:alpha7_pc_loader:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael Heinzl reported this vulnerability to CISA.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
}
],
"trust": 0.6
},
"cve": "CVE-2022-1888",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-1888",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2022-1888",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2022-1888",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202205-4297",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code. Fuji Electric Alpha7 PC Loader",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-1888"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "VULMON",
"id": "CVE-2022-1888"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-1888",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSA-22-151-01",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU95343598",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001947",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2022.2689",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2022060106",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202205-4297",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-1888",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-1888"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"id": "VAR-202205-2013",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.625
},
"last_update_date": "2024-06-15T23:14:12.003000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Stack-based buffer overflow (CWE-121) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-151-01"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95343598/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-1888"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.2689"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-151-01"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-1888/"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2022060106"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-1888"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2022-1888"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
},
{
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-06-02T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"date": "2022-05-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202205-4297"
},
{
"date": "2022-08-31T16:15:09.943000",
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-06-13T08:55:00",
"db": "JVNDB",
"id": "JVNDB-2022-001947"
},
{
"date": "2022-09-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202205-4297"
},
{
"date": "2022-09-07T20:18:37.573000",
"db": "NVD",
"id": "CVE-2022-1888"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Made by Fuji Electric \u00a0Alpha7\u00a0PC\u00a0Loader\u00a0 Stack-based buffer overflow vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-001947"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202205-4297"
}
],
"trust": 0.6
}
}
VAR-202311-1678
Vulnerability from variot - Updated: 2024-01-18 22:47Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file. Fuji Electric's Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator 6 module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202311-1678",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite",
"scope": null,
"trust": 7.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.19.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.19.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.0.19.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
}
],
"trust": 7.7
},
"cve": "CVE-2023-35127",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-35127",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 7.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-35127",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2023-35127",
"trust": 7.7,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2023-35127",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-35127",
"trust": 1.0,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator 6 module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
}
],
"trust": 8.64
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-35127",
"trust": 10.4
},
{
"db": "ICS CERT",
"id": "ICSA-23-325-02",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU98886797",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21214",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1734",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21304",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1733",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21303",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1732",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21302",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1731",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21236",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1728",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21176",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1727",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21178",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1726",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21175",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1723",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21174",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1722",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21215",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1721",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21121",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1720",
"trust": 0.7
},
{
"db": "VULMON",
"id": "CVE-2023-35127",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"id": "VAR-202311-1678",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-01-18T22:47:10.285000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 7.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 9.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"trust": 1.9,
"url": "https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98886797/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-35127"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"date": "2023-11-22T01:15:07.813000",
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1720"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-35127"
},
{
"date": "2024-01-11T02:46:00",
"db": "JVNDB",
"id": "JVNDB-2023-018332"
},
{
"date": "2023-11-30T17:24:26.147000",
"db": "NVD",
"id": "CVE-2023-35127"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator 6 V9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1734"
},
{
"db": "ZDI",
"id": "ZDI-23-1733"
},
{
"db": "ZDI",
"id": "ZDI-23-1732"
},
{
"db": "ZDI",
"id": "ZDI-23-1731"
},
{
"db": "ZDI",
"id": "ZDI-23-1728"
},
{
"db": "ZDI",
"id": "ZDI-23-1727"
},
{
"db": "ZDI",
"id": "ZDI-23-1726"
},
{
"db": "ZDI",
"id": "ZDI-23-1723"
},
{
"db": "ZDI",
"id": "ZDI-23-1722"
},
{
"db": "ZDI",
"id": "ZDI-23-1721"
},
{
"db": "ZDI",
"id": "ZDI-23-1720"
}
],
"trust": 7.7
}
}
VAR-202311-1677
Vulnerability from variot - Updated: 2024-01-18 22:47A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Fuji Electric's Tellus Lite V-Simulator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of any user of the software
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202311-1677",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.19.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.19.0"
},
{
"model": "tellus lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.0.19.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fritz Sands",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
}
],
"trust": 0.7
},
"cve": "CVE-2023-5299",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ics-cert@hq.dhs.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-5299",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"id": "CVE-2023-5299",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2023-5299",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-5299",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2023-5299",
"trust": 0.7,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. Fuji Electric\u0027s Tellus Lite V-Simulator Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the product installer. The issue results from incorrect permissions set on product folders created by the installer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of any user of the software",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-5299",
"trust": 3.4
},
{
"db": "ICS CERT",
"id": "ICSA-23-325-02",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU98886797",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21224",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1730",
"trust": 0.7
},
{
"db": "VULMON",
"id": "CVE-2023-5299",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"id": "VAR-202311-1677",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-01-18T22:47:10.256000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "others (CWE-Other) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.7,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"trust": 1.9,
"url": "https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98886797/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-5299"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"date": "2023-11-22T01:15:08.187000",
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1730"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-5299"
},
{
"date": "2024-01-11T02:33:00",
"db": "JVNDB",
"id": "JVNDB-2023-018322"
},
{
"date": "2023-11-30T17:37:48.917000",
"db": "NVD",
"id": "CVE-2023-5299"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric\u0027s \u00a0Tellus\u00a0Lite\u00a0V-Simulator\u00a0 Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018322"
}
],
"trust": 0.8
}
}
VAR-202311-1679
Vulnerability from variot - Updated: 2024-01-18 22:47When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202311-1679",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tellus lite",
"scope": null,
"trust": 2.8,
"vendor": "fuji electric",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.19.0"
},
{
"model": "tellus lite v-simulator",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "tellus lite v-simulator",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "4.0.19.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.0.19.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
}
],
"trust": 2.8
},
"cve": "CVE-2023-40152",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2023-40152",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.8,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2023-40152",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2023-40152",
"trust": 2.8,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2023-40152",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2023-40152",
"trust": 1.0,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur. (DoS) It may be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of V9 files by the V-Simulator module. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process",
"sources": [
{
"db": "NVD",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
}
],
"trust": 4.23
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2023-40152",
"trust": 5.5
},
{
"db": "ICS CERT",
"id": "ICSA-23-325-02",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU98886797",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21212",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1735",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21238",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1729",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21211",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1725",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-21210",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-23-1724",
"trust": 0.7
},
{
"db": "VULMON",
"id": "CVE-2023-40152",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"id": "VAR-202311-1679",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 1.0
},
"last_update_date": "2024-01-18T22:47:10.218000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 2.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.8,
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-325-02"
},
{
"trust": 1.9,
"url": "https://felib.fujielectric.co.jp/en/m10009/m20034/document_detail/c27d5b69-68ef-4af5-90ee-b5dab118f71a"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu98886797/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2023-40152"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"date": "2024-01-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"date": "2023-11-22T01:15:08.007000",
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1729"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"date": "2023-11-27T00:00:00",
"db": "ZDI",
"id": "ZDI-23-1724"
},
{
"date": "2023-11-22T00:00:00",
"db": "VULMON",
"id": "CVE-2023-40152"
},
{
"date": "2024-01-11T02:35:00",
"db": "JVNDB",
"id": "JVNDB-2023-018324"
},
{
"date": "2023-11-30T17:28:53.117000",
"db": "NVD",
"id": "CVE-2023-40152"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Tellus Lite V-Simulator V9 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-23-1735"
},
{
"db": "ZDI",
"id": "ZDI-23-1725"
},
{
"db": "ZDI",
"id": "ZDI-23-1724"
}
],
"trust": 2.1
}
}
VAR-201809-0083
Vulnerability from variot - Updated: 2023-12-18 13:56A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite 4.0.3.0 and prior. Fuji Electric V-Server Lite Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of VPR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Failed exploit attempts will likely cause a denial-of-service condition. V-Server Lite 4.0.3.0 and prior versions are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201809-0083",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "v-server",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.3.0"
},
{
"model": "v-server",
"scope": "lte",
"trust": 0.8,
"vendor": "fuji electric",
"version": "lite 4.0.3.0"
},
{
"model": "v-server lite",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "v-server",
"scope": "eq",
"trust": 0.6,
"vendor": "fujielectric",
"version": "4.0.3.0"
},
{
"model": "electric v-server lite",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "4.0.3.0"
},
{
"model": "electric v-server lite",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "4.0.0.0"
},
{
"model": "electric v-server lite",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "3.3.22.0"
},
{
"model": "electric v-server lite",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "3.0.1.0"
},
{
"model": "electric v-server lite",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "2.1.36.0"
},
{
"model": "electric v-server lite",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "2.0.0.0"
},
{
"model": "electric v-server lite",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "4.0.4.0"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "BID",
"id": "105328"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:v-server:*:*:*:*:lite:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.0.3.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-10637"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ariele Caltabiano (kimiya)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
}
],
"trust": 0.7
},
"cve": "CVE-2018-10637",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-10637",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2018-10637",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-10637",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-10637",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2018-10637",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-575",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite 4.0.3.0 and prior. Fuji Electric V-Server Lite Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of VPR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. Failed exploit attempts will likely cause a denial-of-service condition. \nV-Server Lite 4.0.3.0 and prior versions are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "BID",
"id": "105328"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-10637",
"trust": 3.4
},
{
"db": "ICS CERT",
"id": "ICSA-18-254-02",
"trust": 2.7
},
{
"db": "BID",
"id": "105328",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-6376",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-1023",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "BID",
"id": "105328"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"id": "VAR-201809-0083",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.87058824
},
"last_update_date": "2023-12-18T13:56:56.234000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/"
},
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-254-02"
},
{
"title": "Fuji Electric V-Server Lite Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=84842"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "NVD",
"id": "CVE-2018-10637"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-254-02"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/105328"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10637"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-10637"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "BID",
"id": "105328"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"db": "BID",
"id": "105328"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-12T00:00:00",
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"date": "2018-09-11T00:00:00",
"db": "BID",
"id": "105328"
},
{
"date": "2018-12-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"date": "2018-09-13T19:29:00.277000",
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"date": "2018-09-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-09-12T00:00:00",
"db": "ZDI",
"id": "ZDI-18-1023"
},
{
"date": "2018-09-11T00:00:00",
"db": "BID",
"id": "105328"
},
{
"date": "2018-12-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"date": "2019-10-09T23:32:58.743000",
"db": "NVD",
"id": "CVE-2018-10637"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server Lite Buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010848"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-575"
}
],
"trust": 0.6
}
}
VAR-201802-1045
Vulnerability from variot - Updated: 2023-12-18 13:52A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution. Fuji Electric V-Server VPR Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of project files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Fuji Electric V-Server is a data collection software from Fuji Electric, Japan, and VPR is an array-based FPGA layout tool. Failed exploit attempts will likely cause a denial-of-service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201802-1045",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "v-server vpr",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.1.0"
},
{
"model": "v-server vpr",
"scope": "lte",
"trust": 0.8,
"vendor": "fuji electric",
"version": "4.0.1.0"
},
{
"model": "v-server",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric v-server vpr",
"scope": "lte",
"trust": 0.6,
"vendor": "fuji",
"version": "\u003c=4.0.1.0"
},
{
"model": "v-server vpr",
"scope": "eq",
"trust": 0.6,
"vendor": "fujielectric",
"version": "4.0.1.0"
},
{
"model": "electric v-server",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "4.0.1.0"
},
{
"model": "electric v-server",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "4.0.3.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "v server vpr",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "BID",
"id": "102903"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:v-server_vpr_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.0.1.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:v-server_vpr:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-5442"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ariele Caltabiano (kimiya)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "BID",
"id": "102903"
}
],
"trust": 1.0
},
"cve": "CVE-2018-5442",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-5442",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2018-5442",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-02828",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 9.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-135473",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-5442",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-5442",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "ZDI",
"id": "CVE-2018-5442",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-02828",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201802-109",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-135473",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "VULHUB",
"id": "VHN-135473"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution. Fuji Electric V-Server VPR Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of project files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Fuji Electric V-Server is a data collection software from Fuji Electric, Japan, and VPR is an array-based FPGA layout tool. Failed exploit attempts will likely cause a denial-of-service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "BID",
"id": "102903"
},
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "VULHUB",
"id": "VHN-135473"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-5442",
"trust": 4.3
},
{
"db": "ICS CERT",
"id": "ICSA-18-032-01",
"trust": 3.4
},
{
"db": "BID",
"id": "102903",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2018-02828",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-5383",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-18-160",
"trust": 0.7
},
{
"db": "IVD",
"id": "E2E378A3-39AB-11E9-A97C-000C29342CB1",
"trust": 0.2
},
{
"db": "SEEBUG",
"id": "SSVID-99015",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-135473",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "VULHUB",
"id": "VHN-135473"
},
{
"db": "BID",
"id": "102903"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"id": "VAR-201802-1045",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "VULHUB",
"id": "VHN-135473"
}
],
"trust": 1.7671123199999998
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
}
]
},
"last_update_date": "2023-12-18T13:52:48.188000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "\u30c8\u30c3\u30d7\u30da\u30fc\u30b8",
"trust": 0.8,
"url": "http://www.fujielectric.co.jp/"
},
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-01"
},
{
"title": "Patch for Fuji Electric V-Server VPR Stack Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/115813"
},
{
"title": "Fuji Electric V-Server VPR Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=78267"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.1
},
{
"problemtype": "CWE-119",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-135473"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "NVD",
"id": "CVE-2018-5442"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-032-01"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/102903"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5442"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-5442"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "VULHUB",
"id": "VHN-135473"
},
{
"db": "BID",
"id": "102903"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"db": "VULHUB",
"id": "VHN-135473"
},
{
"db": "BID",
"id": "102903"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-02-06T00:00:00",
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"date": "2018-02-12T00:00:00",
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"date": "2018-02-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"date": "2018-02-05T00:00:00",
"db": "VULHUB",
"id": "VHN-135473"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102903"
},
{
"date": "2018-03-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"date": "2018-02-05T18:29:00.310000",
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"date": "2018-02-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-02-12T00:00:00",
"db": "ZDI",
"id": "ZDI-18-160"
},
{
"date": "2018-02-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-02828"
},
{
"date": "2020-09-18T00:00:00",
"db": "VULHUB",
"id": "VHN-135473"
},
{
"date": "2018-02-01T00:00:00",
"db": "BID",
"id": "102903"
},
{
"date": "2018-03-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"date": "2020-09-18T15:53:34.097000",
"db": "NVD",
"id": "CVE-2018-5442"
},
{
"date": "2020-09-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server VPR Buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-001880"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "e2e378a3-39ab-11e9-a97c-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201802-109"
}
],
"trust": 0.8
}
}
VAR-201911-1048
Vulnerability from variot - Updated: 2023-12-18 13:52In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary code. Fuji Electric V-Server Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of VPR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Fuji Electric V-Server is a set of software used by Fuji Electric to collect and manage real-time field data.
A buffer overflow vulnerability exists in Fuji Electric V-Server 4.0.6 and earlier. This vulnerability is caused by a network system or product performing an operation on memory that does not properly validate data boundaries, causing an error to be performed on other associated memory locations. Read and write operations that an attacker can exploit to cause a buffer overflow or heap overflow
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201911-1048",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "v-server",
"scope": null,
"trust": 3.5,
"vendor": "fuji electric",
"version": null
},
{
"model": "v-server",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.0.6"
},
{
"model": "v-server",
"scope": "lte",
"trust": 0.8,
"vendor": "fuji electric",
"version": "4.0.6"
},
{
"model": "electric v-server",
"scope": "lte",
"trust": 0.6,
"vendor": "fuji",
"version": "\u003c=4.0.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "v server",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "NVD",
"id": "CVE-2019-18240"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:v-server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.0.6",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-18240"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya of 9SG",
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
],
"trust": 4.1
},
"cve": "CVE-2019-18240",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-18240",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-41427",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2019-18240",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 3.5,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-18240",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2019-18240",
"trust": 3.5,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-18240",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2019-41427",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201911-426",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary code. Fuji Electric V-Server Contains an out-of-bounds vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of VPR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Fuji Electric V-Server is a set of software used by Fuji Electric to collect and manage real-time field data. \n\nA buffer overflow vulnerability exists in Fuji Electric V-Server 4.0.6 and earlier. This vulnerability is caused by a network system or product performing an operation on memory that does not properly validate data boundaries, causing an error to be performed on other associated memory locations. Read and write operations that an attacker can exploit to cause a buffer overflow or heap overflow",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
}
],
"trust": 5.49
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-18240",
"trust": 6.7
},
{
"db": "ICS CERT",
"id": "ICSA-19-311-02",
"trust": 3.0
},
{
"db": "ZDI",
"id": "ZDI-19-971",
"trust": 1.3
},
{
"db": "AUSCERT",
"id": "ESB-2019.4210",
"trust": 1.2
},
{
"db": "CNVD",
"id": "CNVD-2019-41427",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8848",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-19-968",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8931",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-19-970",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8844",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-19-967",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8904",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-19-969",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8932",
"trust": 0.7
},
{
"db": "IVD",
"id": "C161EB5B-3004-48C3-93E9-62AC80F32CD5",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"id": "VAR-201911-1048",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
}
],
"trust": 1.67058824
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
}
]
},
"last_update_date": "2023-12-18T13:52:06.887000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 3.5,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-311-02"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "https://www.fujielectric.com/index.html"
},
{
"title": "Patch for Fuji Electric V-Server Buffer Overflow Vulnerability (CNVD-2019-41427)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/191105"
},
{
"title": "Fuji Electric V-Server Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=103039"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "NVD",
"id": "CVE-2019-18240"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 7.1,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-311-02"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-18240"
},
{
"trust": 1.2,
"url": "https://www.auscert.org.au/bulletins/esb-2019.4210/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-18240"
},
{
"trust": 0.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-19-971/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-11-20T00:00:00",
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"date": "2019-11-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"date": "2019-11-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"date": "2019-11-13T23:15:11.433000",
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"date": "2019-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"date": "2019-11-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-971"
},
{
"date": "2019-11-20T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-41427"
},
{
"date": "2019-11-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-012000"
},
{
"date": "2019-11-18T14:46:45.703000",
"db": "NVD",
"id": "CVE-2019-18240"
},
{
"date": "2020-07-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server VPR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-968"
},
{
"db": "ZDI",
"id": "ZDI-19-970"
},
{
"db": "ZDI",
"id": "ZDI-19-967"
},
{
"db": "ZDI",
"id": "ZDI-19-969"
},
{
"db": "ZDI",
"id": "ZDI-19-971"
}
],
"trust": 3.5
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "c161eb5b-3004-48c3-93e9-62ac80f32cd5"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-426"
}
],
"trust": 0.8
}
}
VAR-201810-0395
Vulnerability from variot - Updated: 2023-12-18 13:48An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1.0.2.0 and prior. Exploitation of this vulnerability could give an attacker access to the system with the same level of privilege as the application that utilizes the malicious DLL. Fuji Electric Energy Savings Estimator is an energy saving estimator of Fuji Electric Corporation. Using this vulnerability, an attacker could use this vulnerability to execute arbitrary code in the affected application environment, and a failed attack could cause a denial of service. Failed exploit attempts will result in a denial of service condition
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201810-0395",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "electric energy savings estimator",
"scope": "eq",
"trust": 1.1,
"vendor": "fuji",
"version": "1.0.2.0"
},
{
"model": "energy savings estimator",
"scope": "eq",
"trust": 1.0,
"vendor": "fujielectric",
"version": "1.0.2.0"
},
{
"model": "energy savings estimator",
"scope": "eq",
"trust": 0.8,
"vendor": "fuji electric",
"version": "v.1.0.2.0 and less"
},
{
"model": "electric energy savings estimator",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "1.0.2.1"
}
],
"sources": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "BID",
"id": "105543"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "NVD",
"id": "CVE-2018-14812"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:energy_savings_estimator:1.0.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14812"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "105543"
}
],
"trust": 0.3
},
"cve": "CVE-2018-14812",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-14812",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "CNVD-2019-44955",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.9,
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-14812",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-14812",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2019-44955",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201810-716",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-14812",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "VULMON",
"id": "CVE-2018-14812"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1.0.2.0 and prior. Exploitation of this vulnerability could give an attacker access to the system with the same level of privilege as the application that utilizes the malicious DLL. Fuji Electric Energy Savings Estimator is an energy saving estimator of Fuji Electric Corporation. Using this vulnerability, an attacker could use this vulnerability to execute arbitrary code in the affected application environment, and a failed attack could cause a denial of service. Failed exploit attempts will result in a denial of service condition",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "BID",
"id": "105543"
},
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "VULMON",
"id": "CVE-2018-14812"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14812",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-18-282-07",
"trust": 2.8
},
{
"db": "BID",
"id": "105543",
"trust": 2.6
},
{
"db": "CNVD",
"id": "CNVD-2019-44955",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893",
"trust": 0.8
},
{
"db": "IVD",
"id": "5E5552AA-F67D-4B14-B207-EC1FB7409507",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2018-14812",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "VULMON",
"id": "CVE-2018-14812"
},
{
"db": "BID",
"id": "105543"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"id": "VAR-201810-0395",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
}
],
"trust": 1.52916665
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
}
]
},
"last_update_date": "2023-12-18T13:48:06.092000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Engineers\u0027 Room",
"trust": 0.8,
"url": "https://americas.fujielectric.com/engineers-room/online-tools/"
},
{
"title": "Patch for Fuji Electric Energy Savings Estimator DLL Loads Local Code Execution Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/193515"
},
{
"title": "Fuji Electric Energy Savings Estimator Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=85811"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-427",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "NVD",
"id": "CVE-2018-14812"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-282-07"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/105543"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14812"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14812"
},
{
"trust": 0.3,
"url": "https://americas.fujielectric.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/427.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "VULMON",
"id": "CVE-2018-14812"
},
{
"db": "BID",
"id": "105543"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"db": "VULMON",
"id": "CVE-2018-14812"
},
{
"db": "BID",
"id": "105543"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-12-11T00:00:00",
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"date": "2019-12-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"date": "2018-10-24T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14812"
},
{
"date": "2018-10-09T00:00:00",
"db": "BID",
"id": "105543"
},
{
"date": "2019-03-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"date": "2018-10-24T21:29:00.563000",
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"date": "2018-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-12-11T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-44955"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14812"
},
{
"date": "2018-10-09T00:00:00",
"db": "BID",
"id": "105543"
},
{
"date": "2019-03-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013893"
},
{
"date": "2019-10-09T23:35:15.843000",
"db": "NVD",
"id": "CVE-2018-14812"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "105543"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Energy Savings Estimator Vulnerable to uncontrolled search path elements",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013893"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code problem",
"sources": [
{
"db": "IVD",
"id": "5e5552aa-f67d-4b14-b207-ec1fb7409507"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-716"
}
],
"trust": 0.8
}
}
VAR-201907-1444
Vulnerability from variot - Updated: 2023-12-18 13:47An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of A7P files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the Administrator. The vulnerability stems from a network system or product that does not properly validate data boundaries when performing operations on memory, causing erroneous read and write operations to be performed on other associated memory locations. An attacker could exploit the vulnerability to cause a buffer overflow or heap overflow. Successfully exploiting this issue allows an attackers to crash the affected application, denying service to legitimate users
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201907-1444",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "alpha7 pc loader",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "1.1"
},
{
"model": "alpha7 pc loader",
"scope": "lte",
"trust": 0.8,
"vendor": "fuji electric",
"version": "1.1"
},
{
"model": "alpha7",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric alpha7 pc loader",
"scope": "lte",
"trust": 0.6,
"vendor": "fuji",
"version": "\u003c=1.1"
},
{
"model": "electric alpha7 pc loader",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "1.1"
},
{
"model": "electric alpha7 pc loader",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "1.2"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "alpha7 pc loader",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "BID",
"id": "108359"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "NVD",
"id": "CVE-2019-10975"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:alpha7_pc_loader_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.1",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:alpha7_pc_loader:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-10975"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "kimiya of 9SG Security Team - kimiya@9sgsec.com",
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-517"
}
],
"trust": 0.7
},
"cve": "CVE-2019-10975",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"impactScore": 4.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 3.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-10975",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-14818",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "f2376594-620a-4edb-9dea-d851708a0067",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"id": "VHN-142575",
"impactScore": 4.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:L/AC:M/AU:N/C:P/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.3,
"impactScore": 5.2,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 6.6,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-10975",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"id": "CVE-2019-10975",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 0.7,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-10975",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "ZDI",
"id": "CVE-2019-10975",
"trust": 0.7,
"value": "LOW"
},
{
"author": "CNVD",
"id": "CNVD-2019-14818",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201905-725",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-142575",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "VULHUB",
"id": "VHN-142575"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An out-of-bounds read vulnerability has been identified in Fuji Electric Alpha7 PC Loader Versions 1.1 and prior, which may crash the system. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of A7P files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the Administrator. The vulnerability stems from a network system or product that does not properly validate data boundaries when performing operations on memory, causing erroneous read and write operations to be performed on other associated memory locations. An attacker could exploit the vulnerability to cause a buffer overflow or heap overflow. \nSuccessfully exploiting this issue allows an attackers to crash the affected application, denying service to legitimate users",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "BID",
"id": "108359"
},
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "VULHUB",
"id": "VHN-142575"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-10975",
"trust": 4.3
},
{
"db": "ICS CERT",
"id": "ICSA-19-136-02",
"trust": 3.4
},
{
"db": "BID",
"id": "108359",
"trust": 2.8
},
{
"db": "ZDI",
"id": "ZDI-19-517",
"trust": 2.4
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2019-14818",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8030",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2019.1786",
"trust": 0.6
},
{
"db": "IVD",
"id": "F2376594-620A-4EDB-9DEA-D851708A0067",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-142575",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "VULHUB",
"id": "VHN-142575"
},
{
"db": "BID",
"id": "108359"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"id": "VAR-201907-1444",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "VULHUB",
"id": "VHN-142575"
}
],
"trust": 1.5875
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
}
]
},
"last_update_date": "2023-12-18T13:47:52.689000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fe Library (ALPHA7 Loader Softwar ver1_2)",
"trust": 0.8,
"url": "https://felib.fujielectric.co.jp/download/search2.htm?dosearch=1\u0026site=global\u0026lang=en\u0026documentgroup=software"
},
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-19-136-02"
},
{
"title": "Patch for Fuji Electric Alpha7 PC Loader Buffer Overflow Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/161745"
},
{
"title": "Fuji Electric Alpha7 PC Loader Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=92858"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-125",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-142575"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "NVD",
"id": "CVE-2019-10975"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.1,
"url": "http://www.securityfocus.com/bid/108359"
},
{
"trust": 2.2,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-19-136-02"
},
{
"trust": 1.7,
"url": "https://www.zerodayinitiative.com/advisories/zdi-19-517/"
},
{
"trust": 1.6,
"url": "https://felib.fujielectric.co.jp/download/search2.htm?dosearch=1\u0026site=global\u0026lang=en\u0026documentgroup=software"
},
{
"trust": 1.4,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-136-02"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-10975"
},
{
"trust": 1.0,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-136-02%2c"
},
{
"trust": 0.9,
"url": "https://americas.fujielectric.com/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10975"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/81230"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.1786/"
},
{
"trust": 0.1,
"url": "https://felib.fujielectric.co.jp/download/search2.htm?dosearch=1\u0026amp;site=global\u0026amp;lang=en\u0026amp;documentgroup=software"
},
{
"trust": 0.1,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-136-02,"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "VULHUB",
"id": "VHN-142575"
},
{
"db": "BID",
"id": "108359"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"db": "VULHUB",
"id": "VHN-142575"
},
{
"db": "BID",
"id": "108359"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-21T00:00:00",
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"date": "2019-05-29T00:00:00",
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"date": "2019-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"date": "2019-07-02T00:00:00",
"db": "VULHUB",
"id": "VHN-142575"
},
{
"date": "2019-05-16T00:00:00",
"db": "BID",
"id": "108359"
},
{
"date": "2019-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"date": "2019-07-02T20:15:11.513000",
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"date": "2019-05-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-05-29T00:00:00",
"db": "ZDI",
"id": "ZDI-19-517"
},
{
"date": "2019-05-21T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-14818"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-142575"
},
{
"date": "2019-05-16T00:00:00",
"db": "BID",
"id": "108359"
},
{
"date": "2019-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-006019"
},
{
"date": "2023-11-07T03:02:36.767000",
"db": "NVD",
"id": "CVE-2019-10975"
},
{
"date": "2019-07-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "108359"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Alpha7 PC Loader Buffer Overflow Vulnerability",
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "CNVD",
"id": "CNVD-2019-14818"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "f2376594-620a-4edb-9dea-d851708a0067"
},
{
"db": "CNNVD",
"id": "CNNVD-201905-725"
}
],
"trust": 0.8
}
}
VAR-201810-0386
Vulnerability from variot - Updated: 2023-12-18 13:43Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. The device does not perform a check on the length/size of a project file before copying the entire contents of the file to a heap-based buffer. Fuji Electric Alpha5 Smart Loader Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. FujiElectricAlpha5SmartLoader is a servo motor product of Fuji Electric of Japan. A heap buffer overflow vulnerability exists in FujiElectricAlpha5SmartLoader 3.7 and earlier. The attacker can exploit the vulnerability to execute the code
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201810-0386",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "alpha5 smart loader",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "3.7"
},
{
"model": "alpha5 smart loader",
"scope": "lte",
"trust": 0.8,
"vendor": "fuji electric",
"version": "3.7"
},
{
"model": "electric alpha5 smart loader",
"scope": "lte",
"trust": 0.6,
"vendor": "fuji",
"version": "\u003c=3.7"
},
{
"model": "electric alpha5 smart loader",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "3.7"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "NVD",
"id": "CVE-2018-14794"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:alpha5_smart_loader_firmware:*:*:*:*:*:*:*:undefined",
"cpe_name": [],
"versionEndIncluding": "3.7",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:alpha5_smart_loader:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14794"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael Flanders and Ghirmay Desta working with Trend Micro??s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "105411"
}
],
"trust": 0.3
},
"cve": "CVE-2018-14794",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-14794",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-03308",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-124989",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-14794",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-14794",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2019-03308",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-1248",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-124989",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-14794",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "VULHUB",
"id": "VHN-124989"
},
{
"db": "VULMON",
"id": "CVE-2018-14794"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. The device does not perform a check on the length/size of a project file before copying the entire contents of the file to a heap-based buffer. Fuji Electric Alpha5 Smart Loader Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. FujiElectricAlpha5SmartLoader is a servo motor product of Fuji Electric of Japan. A heap buffer overflow vulnerability exists in FujiElectricAlpha5SmartLoader 3.7 and earlier. The attacker can exploit the vulnerability to execute the code",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "VULHUB",
"id": "VHN-124989"
},
{
"db": "VULMON",
"id": "CVE-2018-14794"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14794",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSA-18-270-02",
"trust": 2.9
},
{
"db": "BID",
"id": "105411",
"trust": 2.7
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1248",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-03308",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-124989",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-14794",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "VULHUB",
"id": "VHN-124989"
},
{
"db": "VULMON",
"id": "CVE-2018-14794"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
]
},
"id": "VAR-201810-0386",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "VULHUB",
"id": "VHN-124989"
}
],
"trust": 1.33333332
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
}
]
},
"last_update_date": "2023-12-18T13:43:33.258000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ALPHA5 Smart",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/products/servo/alpha5smart/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124989"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "NVD",
"id": "CVE-2018-14794"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-270-02"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/105411"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14794"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14794"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "VULHUB",
"id": "VHN-124989"
},
{
"db": "VULMON",
"id": "CVE-2018-14794"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"db": "VULHUB",
"id": "VHN-124989"
},
{
"db": "VULMON",
"id": "CVE-2018-14794"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"date": "2018-10-01T00:00:00",
"db": "VULHUB",
"id": "VHN-124989"
},
{
"date": "2018-10-01T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14794"
},
{
"date": "2018-09-27T00:00:00",
"db": "BID",
"id": "105411"
},
{
"date": "2019-03-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"date": "2018-10-01T13:29:00.550000",
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"date": "2018-09-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-03308"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-124989"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-14794"
},
{
"date": "2018-09-27T00:00:00",
"db": "BID",
"id": "105411"
},
{
"date": "2019-03-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"date": "2019-10-09T23:35:13.327000",
"db": "NVD",
"id": "CVE-2018-14794"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Alpha5 Smart Loader Buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-013882"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-1248"
}
],
"trust": 0.6
}
}
VAR-201810-0384
Vulnerability from variot - Updated: 2023-12-18 13:43Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. A buffer overflow information disclosure vulnerability occurs when parsing certain file types. FujiElectricAlpha5SmartLoader is a servo motor product of Fuji Electric of Japan. An attacker can exploit these issues to execute arbitrary code in the context of the application, or obtain sensitive information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201810-0384",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "alpha5 smart loader",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "3.7"
},
{
"model": "alpha5 smart loader",
"scope": "lte",
"trust": 0.8,
"vendor": "fuji electric",
"version": "3.7"
},
{
"model": "electric alpha5 smart loader",
"scope": "lte",
"trust": 0.6,
"vendor": "fuji",
"version": "\u003c=3.7"
},
{
"model": "alpha5 smart loader",
"scope": "eq",
"trust": 0.6,
"vendor": "fujielectric",
"version": "3.7"
},
{
"model": "electric alpha5 smart loader",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "3.7"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:alpha5_smart_loader_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.7",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:alpha5_smart_loader:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14788"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael Flanders and Ghirmay Desta working with Trend Micro??s Zero Day Initiative",
"sources": [
{
"db": "BID",
"id": "105411"
}
],
"trust": 0.3
},
"cve": "CVE-2018-14788",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-14788",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-03307",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-124982",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2018-14788",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-14788",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2019-03307",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201809-1247",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-124982",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "VULHUB",
"id": "VHN-124982"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. A buffer overflow information disclosure vulnerability occurs when parsing certain file types. FujiElectricAlpha5SmartLoader is a servo motor product of Fuji Electric of Japan. \nAn attacker can exploit these issues to execute arbitrary code in the context of the application, or obtain sensitive information",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "VULHUB",
"id": "VHN-124982"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-14788",
"trust": 3.4
},
{
"db": "ICS CERT",
"id": "ICSA-18-270-02",
"trust": 2.8
},
{
"db": "BID",
"id": "105411",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2019-03307",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-124982",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "VULHUB",
"id": "VHN-124982"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"id": "VAR-201810-0384",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "VULHUB",
"id": "VHN-124982"
}
],
"trust": 1.33333332
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
}
]
},
"last_update_date": "2023-12-18T13:43:33.224000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ALPHA5 Smart",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/products/servo/alpha5smart/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.1
},
{
"problemtype": "CWE-119",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-124982"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "NVD",
"id": "CVE-2018-14788"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-270-02"
},
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/105411"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-14788"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-14788"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "VULHUB",
"id": "VHN-124982"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"db": "VULHUB",
"id": "VHN-124982"
},
{
"db": "BID",
"id": "105411"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"date": "2018-10-01T00:00:00",
"db": "VULHUB",
"id": "VHN-124982"
},
{
"date": "2018-09-27T00:00:00",
"db": "BID",
"id": "105411"
},
{
"date": "2019-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"date": "2018-10-01T13:29:00.317000",
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"date": "2018-09-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-01-30T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-03307"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-124982"
},
{
"date": "2018-09-27T00:00:00",
"db": "BID",
"id": "105411"
},
{
"date": "2019-01-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"date": "2019-10-09T23:35:12.453000",
"db": "NVD",
"id": "CVE-2018-14788"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Alpha5 Smart Loader Buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-011285"
},
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201809-1247"
}
],
"trust": 0.6
}
}
VAR-201908-0869
Vulnerability from variot - Updated: 2023-12-18 13:23Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application. Alpha5 Smart Loader Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Alpha5. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PLD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of an administrator
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201908-0869",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "alpha5",
"scope": null,
"trust": 3.5,
"vendor": "fuji electric",
"version": null
},
{
"model": "alpha5 smart loader",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.2"
},
{
"model": "alpha5 smart loader",
"scope": "lt",
"trust": 0.8,
"vendor": "fuji electric",
"version": "4.2"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "NVD",
"id": "CVE-2019-13520"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:alpha5_smart_loader_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:alpha5_smart_loader:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-13520"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Natnael Samson (@NattiSamson)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
}
],
"trust": 3.5
},
"cve": "CVE-2019-13520",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-13520",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2019-13520",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 3.5,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-13520",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2019-13520",
"trust": 3.5,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-13520",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201908-1135",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application. Alpha5 Smart Loader Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Alpha5. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PLD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of an administrator",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
}
],
"trust": 4.77
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-13520",
"trust": 5.9
},
{
"db": "ICS CERT",
"id": "ICSA-19-227-02",
"trust": 2.4
},
{
"db": "ZDI",
"id": "ZDI-19-798",
"trust": 2.3
},
{
"db": "ZDI",
"id": "ZDI-19-820",
"trust": 2.3
},
{
"db": "ZDI",
"id": "ZDI-19-763",
"trust": 1.3
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8566",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8756",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-19-762",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8590",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8568",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-19-761",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-8772",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2019.3148",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201908-1135",
"trust": 0.6
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"id": "VAR-201908-0869",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.43333334
},
"last_update_date": "2023-12-18T13:23:38.015000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 3.5,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-227-02"
},
{
"title": "ALPHA5 Smart",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/products/servo/alpha5smart/overview/index.html"
},
{
"title": "Fuji Electric Alpha5 Smart Loader Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=96796"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-119",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "NVD",
"id": "CVE-2019-13520"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 6.5,
"url": "https://www.us-cert.gov/ics/advisories/icsa-19-227-02"
},
{
"trust": 1.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-19-798/"
},
{
"trust": 1.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-19-820/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13520"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13520"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.3148/"
},
{
"trust": 0.6,
"url": "https://www.zerodayinitiative.com/advisories/zdi-19-763/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-09-05T00:00:00",
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"date": "2019-08-19T00:00:00",
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"date": "2019-09-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"date": "2019-08-19T00:00:00",
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"date": "2019-08-19T00:00:00",
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"date": "2019-09-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"date": "2019-08-20T20:15:11.933000",
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"date": "2019-08-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-09-05T00:00:00",
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"date": "2019-08-19T00:00:00",
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"date": "2019-09-11T00:00:00",
"db": "ZDI",
"id": "ZDI-19-820"
},
{
"date": "2019-08-19T00:00:00",
"db": "ZDI",
"id": "ZDI-19-761"
},
{
"date": "2019-08-19T00:00:00",
"db": "ZDI",
"id": "ZDI-19-763"
},
{
"date": "2019-09-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-008520"
},
{
"date": "2020-10-16T13:22:25.857000",
"db": "NVD",
"id": "CVE-2019-13520"
},
{
"date": "2020-10-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Alpha5 SDP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-19-798"
},
{
"db": "ZDI",
"id": "ZDI-19-762"
},
{
"db": "ZDI",
"id": "ZDI-19-763"
}
],
"trust": 2.1
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201908-1135"
}
],
"trust": 0.6
}
}
VAR-201708-1406
Vulnerability from variot - Updated: 2023-12-18 13:08A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. The stack-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution. Fuji Electric Monitouch V-SFT Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of a V8 project file. The issue lies in the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process. Fuji Electric Monitouch V-SFT is an HMI software. Failed exploit attempts will result in denial-of-service conditions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1406",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "monitouch v-sft",
"scope": null,
"trust": 1.4,
"vendor": "fuji electric",
"version": null
},
{
"model": "monitouch v-sft",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "5.4.42.0"
},
{
"model": "monitouch v-sft",
"scope": "lt",
"trust": 0.8,
"vendor": "fuji electric",
"version": "5.4.43.0"
},
{
"model": "electric monitouch v-sft",
"scope": "lt",
"trust": 0.6,
"vendor": "fuji",
"version": "5.4.43.0"
},
{
"model": "monitouch v-sft",
"scope": "eq",
"trust": 0.6,
"vendor": "fujielectric",
"version": "5.4.42.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "5.4.42.0"
},
{
"model": "electric monitouch v-sft",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "5.4.43.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "monitouch v sft",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.4.42.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9659"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ariele Caltabiano (kimiya)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
}
],
"trust": 1.4
},
"cve": "CVE-2017-9659",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-9659",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 2.2,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-22804",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-9659",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-9659",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2017-9659",
"trust": 1.4,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-22804",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-578",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. The stack-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution. Fuji Electric Monitouch V-SFT Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of a V8 project file. The issue lies in the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process. Fuji Electric Monitouch V-SFT is an HMI software. Failed exploit attempts will result in denial-of-service conditions",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
}
],
"trust": 3.87
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9659",
"trust": 4.9
},
{
"db": "ICS CERT",
"id": "ICSA-17-222-04",
"trust": 3.3
},
{
"db": "ZDI",
"id": "ZDI-17-644",
"trust": 2.6
},
{
"db": "ZDI",
"id": "ZDI-17-643",
"trust": 2.6
},
{
"db": "BID",
"id": "100265",
"trust": 1.3
},
{
"db": "CNVD",
"id": "CNVD-2017-22804",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4014",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-3993",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-645",
"trust": 0.3
},
{
"db": "IVD",
"id": "E14E25DD-B97B-42E6-840A-4D68E6949FDB",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"id": "VAR-201708-1406",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
}
],
"trust": 1.4500000000000002
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
}
]
},
"last_update_date": "2023-12-18T13:08:44.247000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 1.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-222-04"
},
{
"title": "Monitouch V-SFT",
"trust": 0.8,
"url": "http://www.hakko-elec.co.jp/site/vsft/"
},
{
"title": "Fuji Electric Monitouch V-SFT project file parsing heap buffer overflow vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/100821"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "NVD",
"id": "CVE-2017-9659"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-222-04"
},
{
"trust": 1.9,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-643/"
},
{
"trust": 1.9,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-644/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9659"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/100265"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9659"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
},
{
"trust": 0.3,
"url": "www.zerodayinitiative.com/advisories/zdi-17-645"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"date": "2017-08-10T00:00:00",
"db": "BID",
"id": "100265"
},
{
"date": "2017-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"date": "2017-08-14T16:29:00.320000",
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"date": "2017-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-643"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22804"
},
{
"date": "2017-08-10T00:00:00",
"db": "BID",
"id": "100265"
},
{
"date": "2017-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007179"
},
{
"date": "2017-08-24T17:11:43.013000",
"db": "NVD",
"id": "CVE-2017-9659"
},
{
"date": "2017-08-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Monitouch V-SFT Project File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-644"
},
{
"db": "ZDI",
"id": "ZDI-17-643"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "e14e25dd-b97b-42e6-840a-4d68e6949fdb"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-578"
}
],
"trust": 0.8
}
}
VAR-201708-1407
Vulnerability from variot - Updated: 2023-12-18 13:08A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. A heap-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution. Fuji Electric Monitouch V-SFT Contains a buffer error vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of a V8 project file. The issue lies in the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process. Fuji Electric Monitouch V-SFT is an HMI software. Failed exploit attempts will result in denial-of-service conditions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1407",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "monitouch v-sft",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "5.4.42.0"
},
{
"model": "monitouch v-sft",
"scope": "lt",
"trust": 0.8,
"vendor": "fuji electric",
"version": "5.4.43.0"
},
{
"model": "monitouch v-sft",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric monitouch v-sft",
"scope": "lt",
"trust": 0.6,
"vendor": "fuji",
"version": "5.4.43.0"
},
{
"model": "monitouch v-sft",
"scope": "eq",
"trust": 0.6,
"vendor": "fujielectric",
"version": "5.4.42.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "5.4.42.0"
},
{
"model": "electric monitouch v-sft",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "5.4.43.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "monitouch v sft",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.4.42.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9660"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ariele Caltabiano (kimiya)",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-645"
}
],
"trust": 0.7
},
"cve": "CVE-2017-9660",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-9660",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 1.5,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2017-22805",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2017-9660",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-9660",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "CVE-2017-9660",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-22805",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-577",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. A heap-based buffer overflow vulnerability has been identified, which may cause a crash or allow remote code execution. Fuji Electric Monitouch V-SFT Contains a buffer error vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of a V8 project file. The issue lies in the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process. Fuji Electric Monitouch V-SFT is an HMI software. Failed exploit attempts will result in denial-of-service conditions",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9660",
"trust": 4.2
},
{
"db": "ICS CERT",
"id": "ICSA-17-222-04",
"trust": 3.3
},
{
"db": "ZDI",
"id": "ZDI-17-645",
"trust": 2.6
},
{
"db": "BID",
"id": "100265",
"trust": 1.3
},
{
"db": "CNVD",
"id": "CNVD-2017-22805",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-3994",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-17-643",
"trust": 0.3
},
{
"db": "ZDI",
"id": "ZDI-17-644",
"trust": 0.3
},
{
"db": "IVD",
"id": "FE17C188-7216-4DD6-AA4D-FFAE1D06D92B",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"id": "VAR-201708-1407",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
}
],
"trust": 1.4500000000000002
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
}
]
},
"last_update_date": "2023-12-18T13:08:44.207000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Monitouch V-SFT",
"trust": 0.8,
"url": "http://www.hakko-elec.co.jp/site/vsft/"
},
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-222-04"
},
{
"title": "Patch for Fuji Electric Monitouch V-SFT Project File Parsing Buffer Buffer Overflow Vulnerability (CNVD-2017-22805)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/100820"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "NVD",
"id": "CVE-2017-9660"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-222-04"
},
{
"trust": 1.6,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-645/"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9660"
},
{
"trust": 1.0,
"url": "http://www.securityfocus.com/bid/100265"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9660"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-643/"
},
{
"trust": 0.3,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-644/"
},
{
"trust": 0.3,
"url": "www.zerodayinitiative.com/advisories/zdi-17-645"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"db": "BID",
"id": "100265"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"date": "2017-08-10T00:00:00",
"db": "BID",
"id": "100265"
},
{
"date": "2017-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"date": "2017-08-14T16:29:00.350000",
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"date": "2017-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-645"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22805"
},
{
"date": "2017-08-10T00:00:00",
"db": "BID",
"id": "100265"
},
{
"date": "2017-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"date": "2017-08-24T14:17:11.887000",
"db": "NVD",
"id": "CVE-2017-9660"
},
{
"date": "2018-01-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Monitouch V-SFT Buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007180"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer overflow",
"sources": [
{
"db": "IVD",
"id": "fe17c188-7216-4dd6-aa4d-ffae1d06d92b"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-577"
}
],
"trust": 0.8
}
}
VAR-201708-1409
Vulnerability from variot - Updated: 2023-12-18 13:08An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT is installed in a directory with weak access controls by default, which could allow an authenticated attacker with local access to escalate privileges. Fuji Electric Monitouch V-SFT Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows local attackers to escalate their privileges on vulnerable installations of Fuji Electric Monitouch V-SFT. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the configuration of Monitouch V-SFT. An attacker can leverage this vulnerability to execute code in the context of any user of the software. Fuji Electric Monitouch V-SFT is an HMI software
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1409",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "monitouch v-sft",
"scope": "lte",
"trust": 1.0,
"vendor": "fujielectric",
"version": "5.4.42.0"
},
{
"model": "monitouch v-sft",
"scope": "lt",
"trust": 0.8,
"vendor": "fuji electric",
"version": "5.4.43.0"
},
{
"model": "monitouch v-sft",
"scope": null,
"trust": 0.7,
"vendor": "fuji electric",
"version": null
},
{
"model": "electric monitouch v-sft",
"scope": "lt",
"trust": 0.6,
"vendor": "fuji",
"version": "5.4.43.0"
},
{
"model": "monitouch v-sft",
"scope": "eq",
"trust": 0.6,
"vendor": "fujielectric",
"version": "5.4.42.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "5.4.42.0"
},
{
"model": "electric monitouch v-sft",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "5.4.43.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "monitouch v sft",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "BID",
"id": "100268"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "5.4.42.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9662"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fritz Sands of the Zero Day Initiative",
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "BID",
"id": "100268"
}
],
"trust": 1.0
},
"cve": "CVE-2017-9662",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 4.6,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2017-9662",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"id": "CVE-2017-9662",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CNVD-2017-22806",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 1.8,
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 5.3,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2017-9662",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2017-9662",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "ZDI",
"id": "CVE-2017-9662",
"trust": 0.7,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2017-22806",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-575",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An Improper Privilege Management issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. Monitouch V-SFT is installed in a directory with weak access controls by default, which could allow an authenticated attacker with local access to escalate privileges. Fuji Electric Monitouch V-SFT Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows local attackers to escalate their privileges on vulnerable installations of Fuji Electric Monitouch V-SFT. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the configuration of Monitouch V-SFT. An attacker can leverage this vulnerability to execute code in the context of any user of the software. Fuji Electric Monitouch V-SFT is an HMI software",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "BID",
"id": "100268"
},
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
}
],
"trust": 3.24
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9662",
"trust": 4.2
},
{
"db": "ICS CERT",
"id": "ICSA-17-222-04",
"trust": 3.3
},
{
"db": "ZDI",
"id": "ZDI-17-646",
"trust": 2.6
},
{
"db": "BID",
"id": "100268",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2017-22806",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-4021",
"trust": 0.7
},
{
"db": "IVD",
"id": "2BE44727-F1CD-4BAD-8264-9B7730B4F5E3",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "BID",
"id": "100268"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"id": "VAR-201708-1409",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
}
],
"trust": 1.4500000000000002
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
}
]
},
"last_update_date": "2023-12-18T13:08:44.167000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Monitouch V-SFT",
"trust": 0.8,
"url": "http://www.hakko-elec.co.jp/site/vsft/"
},
{
"title": "Fuji Electric has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-222-04"
},
{
"title": "Fuji Electric Monitouch V-SFT Unsafe Configuration Privilege Upgrade Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/100818"
},
{
"title": "Fuji Electric Monitouch V-SFT Fixes for permission permissions and access control vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=99846"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-269",
"trust": 1.0
},
{
"problemtype": "CWE-264",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "NVD",
"id": "CVE-2017-9662"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-222-04"
},
{
"trust": 1.9,
"url": "http://www.zerodayinitiative.com/advisories/zdi-17-646/"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/100268"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9662"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9662"
},
{
"trust": 0.3,
"url": "http://www.fujielectric.com/"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "BID",
"id": "100268"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"db": "BID",
"id": "100268"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-25T00:00:00",
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"date": "2017-08-10T00:00:00",
"db": "BID",
"id": "100268"
},
{
"date": "2017-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"date": "2017-08-14T16:29:00.413000",
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"date": "2017-06-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-10T00:00:00",
"db": "ZDI",
"id": "ZDI-17-646"
},
{
"date": "2017-08-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-22806"
},
{
"date": "2017-08-10T00:00:00",
"db": "BID",
"id": "100268"
},
{
"date": "2017-09-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007182"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2017-9662"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "100268"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric Monitouch V-SFT Insecure Configuration Privilege Escalation Vulnerability",
"sources": [
{
"db": "IVD",
"id": "2be44727-f1cd-4bad-8264-9b7730b4f5e3"
},
{
"db": "ZDI",
"id": "ZDI-17-646"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-575"
}
],
"trust": 0.6
}
}
VAR-201906-0328
Vulnerability from variot - Updated: 2023-12-18 13:02Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server. Fuji Electric V-Server Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Fuji Electric V-Server is prone to multiple security vulnerabilities: 1. A remote denial-of-service vulnerability 2. An information disclosure vulnerability An attacker can exploit these issues to cause a denial-of-service condition or obtain sensitive information that may lead to further attacks . Versions prior to V-SFT 6.0.33.0 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201906-0328",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "v-server",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "6.0.33.0"
},
{
"model": "v-server",
"scope": "lt",
"trust": 0.8,
"vendor": "fuji electric",
"version": "6.0.33.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.9.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.8.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.7.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.6.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.5.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.4.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.32.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.31.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.30.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.3.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.29.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.28.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.27.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.26.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.25.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.24.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.23.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.22.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.21.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.20.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.2.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.19.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.18.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.17.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.16.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.15.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.14.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.13.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.12.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.11.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.10.0"
},
{
"model": "electric monitouch v-sft",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.33.0"
}
],
"sources": [
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3947"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:v-server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.33.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-3947"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tenable",
"sources": [
{
"db": "BID",
"id": "108740"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
],
"trust": 0.9
},
"cve": "CVE-2019-3947",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-3947",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-3947",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-3947",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-201906-558",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2019-3947",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-3947"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server. Fuji Electric V-Server Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Fuji Electric V-Server is prone to multiple security vulnerabilities:\n1. A remote denial-of-service vulnerability\n2. An information disclosure vulnerability\nAn attacker can exploit these issues to cause a denial-of-service condition or obtain sensitive information that may lead to further attacks . \nVersions prior to V-SFT 6.0.33.0 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "VULMON",
"id": "CVE-2019-3947"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "TENABLE",
"id": "TRA-2019-27",
"trust": 2.8
},
{
"db": "NVD",
"id": "CVE-2019-3947",
"trust": 2.8
},
{
"db": "BID",
"id": "108740",
"trust": 2.0
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2019-3947",
"trust": 0.1
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-3947"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"id": "VAR-201906-0328",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.65
},
"last_update_date": "2023-12-18T13:02:12.390000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "V-Server",
"trust": 0.8,
"url": "https://monitouch.fujielectric.com/site/tellus-e/tellus03-01.html"
},
{
"title": "Fuji Electric V-Server Repair measures for trust management problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=93790"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-522",
"trust": 1.0
},
{
"problemtype": "CWE-255",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3947"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "https://www.tenable.com/security/research/tra-2019-27"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/108740"
},
{
"trust": 0.9,
"url": "http://www.fujielectric.com/"
},
{
"trust": 0.9,
"url": "https://monitouch.fujielectric.com/site/support-e/more-index-t.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3947"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-3947"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/522.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2019-3947"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULMON",
"id": "CVE-2019-3947"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-06-12T00:00:00",
"db": "VULMON",
"id": "CVE-2019-3947"
},
{
"date": "2019-06-11T00:00:00",
"db": "BID",
"id": "108740"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"date": "2019-06-12T15:29:00.910000",
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"date": "2019-06-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-24T00:00:00",
"db": "VULMON",
"id": "CVE-2019-3947"
},
{
"date": "2019-06-11T00:00:00",
"db": "BID",
"id": "108740"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"date": "2020-08-24T17:37:01.140000",
"db": "NVD",
"id": "CVE-2019-3947"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server Vulnerabilities related to certificate and password management",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-558"
}
],
"trust": 0.6
}
}
VAR-201906-0327
Vulnerability from variot - Updated: 2023-12-18 13:02Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. An unauthenticated, remote attacker can crash vserver.exe due to an integer overflow in the UDP message handling logic. Fuji Electric V-Server Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Fuji Electric V-Server is a set of software used by Fuji Electric to collect and manage real-time field data. An input validation error vulnerability exists in Fuji Electric V-Server prior to 6.0.33.0. The vulnerability stems from a network system or product that does not properly validate the input data. A remote denial-of-service vulnerability 2. An information disclosure vulnerability An attacker can exploit these issues to cause a denial-of-service condition or obtain sensitive information that may lead to further attacks . Versions prior to V-SFT 6.0.33.0 are vulnerable
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201906-0327",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "v-server",
"scope": "lt",
"trust": 1.6,
"vendor": "fuji electric",
"version": "6.0.33.0"
},
{
"model": "v-server",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "6.0.33.0"
},
{
"model": "electric v-server",
"scope": "lt",
"trust": 0.6,
"vendor": "fuji",
"version": "6.0.33.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.9.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.8.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.7.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.6.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.5.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.4.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.32.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.31.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.30.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.3.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.29.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.28.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.27.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.26.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.25.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.24.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.23.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.22.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.21.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.20.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.2.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.19.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.18.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.17.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.16.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.15.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.14.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.13.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.12.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.11.0"
},
{
"model": "electric monitouch v-sft",
"scope": "eq",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.10.0"
},
{
"model": "electric monitouch v-sft",
"scope": "ne",
"trust": 0.3,
"vendor": "fuji",
"version": "6.0.33.0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "v server",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3946"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:fujielectric:v-server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "6.0.33.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2019-3946"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tenable",
"sources": [
{
"db": "BID",
"id": "108740"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
],
"trust": 0.9
},
"cve": "CVE-2019-3946",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-3946",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 5.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2019-3946",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2019-25688",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 7.5,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2019-3946",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-3946",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2019-3946",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2019-3946",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2019-25688",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201906-559",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2019-3946",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "VULMON",
"id": "CVE-2019-3946"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. An unauthenticated, remote attacker can crash vserver.exe due to an integer overflow in the UDP message handling logic. Fuji Electric V-Server Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Fuji Electric V-Server is a set of software used by Fuji Electric to collect and manage real-time field data. An input validation error vulnerability exists in Fuji Electric V-Server prior to 6.0.33.0. The vulnerability stems from a network system or product that does not properly validate the input data. A remote denial-of-service vulnerability\n2. An information disclosure vulnerability\nAn attacker can exploit these issues to cause a denial-of-service condition or obtain sensitive information that may lead to further attacks . \nVersions prior to V-SFT 6.0.33.0 are vulnerable",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "VULMON",
"id": "CVE-2019-3946"
}
],
"trust": 3.42
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-3946",
"trust": 4.4
},
{
"db": "TENABLE",
"id": "TRA-2019-27",
"trust": 4.2
},
{
"db": "BID",
"id": "108740",
"trust": 2.0
},
{
"db": "CNVD",
"id": "CNVD-2019-25688",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462",
"trust": 0.8
},
{
"db": "IVD",
"id": "B858CD6C-22D1-49A4-A77A-E989933C9367",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2019-3946",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "VULMON",
"id": "CVE-2019-3946"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"id": "VAR-201906-0327",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
}
],
"trust": 1.56029412
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
}
]
},
"last_update_date": "2023-12-18T13:02:12.348000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "V-Server",
"trust": 1.6,
"url": "https://monitouch.fujielectric.com/site/tellus-e/tellus03-01.html"
},
{
"title": "Fuji Electric V-Server enters a patch to verify the error vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/172789"
},
{
"title": "Fuji Electric V-Server Enter the fix for the verification error vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=93791"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-190",
"trust": 1.8
},
{
"problemtype": "CWE-255",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3946"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.2,
"url": "https://www.tenable.com/security/research/tra-2019-27"
},
{
"trust": 1.8,
"url": "http://www.securityfocus.com/bid/108740"
},
{
"trust": 0.9,
"url": "http://www.fujielectric.com/"
},
{
"trust": 0.9,
"url": "https://monitouch.fujielectric.com/site/support-e/more-index-t.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3946"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-3946"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3947"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-3947"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/190.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "VULMON",
"id": "CVE-2019-3946"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "VULMON",
"id": "CVE-2019-3946"
},
{
"db": "BID",
"id": "108740"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-08-02T00:00:00",
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"date": "2019-08-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"date": "2019-06-12T00:00:00",
"db": "VULMON",
"id": "CVE-2019-3946"
},
{
"date": "2019-06-11T00:00:00",
"db": "BID",
"id": "108740"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"date": "2019-06-12T15:29:00.863000",
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"date": "2019-06-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-08-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"date": "2019-06-14T00:00:00",
"db": "VULMON",
"id": "CVE-2019-3946"
},
{
"date": "2019-06-11T00:00:00",
"db": "BID",
"id": "108740"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005490"
},
{
"date": "2019-06-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-005462"
},
{
"date": "2019-06-14T14:30:30.813000",
"db": "NVD",
"id": "CVE-2019-3946"
},
{
"date": "2019-06-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Fuji Electric V-Server Input validation error vulnerability",
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNVD",
"id": "CNVD-2019-25688"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input validation error",
"sources": [
{
"db": "IVD",
"id": "b858cd6c-22d1-49a4-a77a-e989933c9367"
},
{
"db": "CNNVD",
"id": "CNNVD-201906-559"
}
],
"trust": 0.8
}
}
VAR-202110-2123
Vulnerability from variot - Updated: 2023-12-18 12:55The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Alpha5 Smart Loader An out-of-bounds write vulnerability exists in the firmware.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of C5P files in the Server Operator module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202110-2123",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "alpha5",
"scope": null,
"trust": 1.4,
"vendor": "fuji electric",
"version": null
},
{
"model": "alpha5 smart loader",
"scope": "lt",
"trust": 1.0,
"vendor": "fujielectric",
"version": "4.3"
},
{
"model": "alpha5 smart loader",
"scope": null,
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
},
{
"model": "alpha5 smart loader",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": "alpha5 smart loader firmware"
},
{
"model": "alpha5 smart loader",
"scope": "eq",
"trust": 0.8,
"vendor": "\u5bcc\u58eb\u96fb\u6a5f",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fujielectric:alpha5_smart_loader_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "4.3",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:fujielectric:alpha5_smart_loader:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21228"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xina1i",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
}
],
"trust": 1.4
},
"cve": "CVE-2022-21228",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2022-21228",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2022-21228",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "MEDIUM",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2022-21228",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.4,
"userInteraction": "REQUIRED",
"vectorString": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-21228",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2022-21228",
"trust": 1.4,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-21228",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "ics-cert@hq.dhs.gov",
"id": "CVE-2022-21228",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-21228",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNNVD",
"id": "CNNVD-202203-2663",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2022-21228",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"db": "VULMON",
"id": "CVE-2022-21228"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Alpha5 Smart Loader An out-of-bounds write vulnerability exists in the firmware.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of C5P files in the Server Operator module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"db": "VULMON",
"id": "CVE-2022-21228"
}
],
"trust": 2.97
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-21228",
"trust": 4.7
},
{
"db": "ICS CERT",
"id": "ICSA-22-090-03",
"trust": 2.5
},
{
"db": "JVN",
"id": "JVNVU94149543",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-13990",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-389",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-13941",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-21-1209",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-202203-2663",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-21228",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"db": "VULMON",
"id": "CVE-2022-21228"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"id": "VAR-202110-2123",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.43333334
},
"last_update_date": "2023-12-18T12:55:24.889000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "top page",
"trust": 0.8,
"url": "https://www.fujielectric.co.jp/"
},
{
"title": "Fuji Electric Alpha5 Buffer error vulnerability fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=190334"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "Out-of-bounds writing (CWE-787) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-03"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu94149543/index.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21228"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-21228/"
},
{
"trust": 0.6,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-090-03"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/787.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2022-21228"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"db": "VULMON",
"id": "CVE-2022-21228"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-02-22T00:00:00",
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"date": "2021-10-15T00:00:00",
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"date": "2022-04-12T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21228"
},
{
"date": "2022-04-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"date": "2022-04-12T17:15:09.227000",
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"date": "2022-03-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-23T00:00:00",
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"date": "2022-03-23T00:00:00",
"db": "ZDI",
"id": "ZDI-21-1209"
},
{
"date": "2022-04-21T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21228"
},
{
"date": "2022-04-21T06:03:00",
"db": "JVNDB",
"id": "JVNDB-2022-001567"
},
{
"date": "2022-04-21T15:09:13.553000",
"db": "NVD",
"id": "CVE-2022-21228"
},
{
"date": "2022-04-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "(0Day) Fuji Electric Alpha5 Servo Operator C5P File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-389"
},
{
"db": "ZDI",
"id": "ZDI-21-1209"
}
],
"trust": 1.4
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202203-2663"
}
],
"trust": 0.6
}
}
CVE-2024-37029 (GCVE-0-2024-37029)
Vulnerability from nvd – Published: 2024-06-13 17:23 – Updated: 2024-08-02 03:43
VLAI
EPSS
VEX
Title
Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow
Summary
Fuji Electric Tellus Lite V-Simulator
is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-13 18:55 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Tellus Lite V-Simulator |
Affected:
0 , < 4.0.20.0
(custom)
|
|
| fujielectric | tellus_lite_v-simulator |
Affected:
0 , < 4.0.20.0
(custom)
cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:* |
Date Public
2024-06-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tellus_lite_v-simulator",
"vendor": "fujielectric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37029",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-13T18:55:22.773512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T18:51:36.731Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.796Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tellus Lite V-Simulator",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-06-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric Tellus Lite V-Simulator \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.\n\n"
}
],
"value": "Fuji Electric Tellus Lite V-Simulator \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T17:23:40.591Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFuji Electric recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d\"\u003ev4.0.20.0\u003c/a\u003e.\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update to v4.0.20.0 https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d ."
}
],
"source": {
"advisory": "ICSA-24-165-14",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-37029",
"datePublished": "2024-06-13T17:23:40.591Z",
"dateReserved": "2024-06-06T17:39:34.317Z",
"dateUpdated": "2024-08-02T03:43:50.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37022 (GCVE-0-2024-37022)
Vulnerability from nvd – Published: 2024-06-13 17:25 – Updated: 2024-08-02 03:43
VLAI
EPSS
VEX
Title
Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write
Summary
Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-19 18:48 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Tellus Lite V-Simulator |
Affected:
0 , < 4.0.20.0
(custom)
|
|
| fujielectric | tellus_lite_v-simulator |
Affected:
0 , < 4.0.20.0
(custom)
cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:* |
Date Public
2024-06-13 17:00
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:tellus_lite_v-simulator:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "tellus_lite_v-simulator",
"vendor": "fujielectric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37022",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-19T18:48:57.921592Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-19T18:51:44.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.589Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tellus Lite V-Simulator",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "4.0.20.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"datePublic": "2024-06-13T17:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code.\u003c/span\u003e\n\n\u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "Fuji Electric Tellus Lite V-Simulator is vulnerable to an out-of-bounds write, which could allow an attacker to manipulate memory, resulting in execution of arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T17:25:49.609Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-14"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFuji Electric recommends users update to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d\"\u003ev4.0.20.0\u003c/a\u003e.\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update to v4.0.20.0 https://felib.fujielectric.co.jp/en/M10009/M20034/document_detail/a1f9328f-82f4-434a-b593-32874d1e897d ."
}
],
"source": {
"advisory": "ICSA-24-165-14",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-37022",
"datePublished": "2024-06-13T17:25:49.609Z",
"dateReserved": "2024-06-06T17:39:34.310Z",
"dateUpdated": "2024-08-02T03:43:50.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5597 (GCVE-0-2024-5597)
Vulnerability from nvd – Published: 2024-06-10 16:53 – Updated: 2024-08-01 21:18
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT Type Confusion
Summary
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-10 20:11 UTC
CWE
- CWE-843 - Type Confusion
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
0 , < 6.2.3.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-10T20:11:14.382101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T20:12:13.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric Monitouch V-SFT\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eis vulnerable to a type confusion, which could cause a crash or code execution.\u003c/span\u003e\n\n"
}
],
"value": "Fuji Electric Monitouch V-SFT\u00a0is vulnerable to a type confusion, which could cause a crash or code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Type Confusion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-10T16:53:50.147Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric recommends users update the product to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd\"\u003eMonitouch V-SFT v6.2.3.0\u003c/a\u003e.\n\n\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update the product to Monitouch V-SFT v6.2.3.0 https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd ."
}
],
"source": {
"advisory": "ICSA-24-151-02",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Monitouch V-SFT Type Confusion",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5597",
"datePublished": "2024-06-10T16:53:50.147Z",
"dateReserved": "2024-06-03T13:32:22.404Z",
"dateUpdated": "2024-08-01T21:18:06.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5271 (GCVE-0-2024-5271)
Vulnerability from nvd – Published: 2024-05-30 19:53 – Updated: 2025-07-24 14:42
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')
Summary
Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a
type confusion, which could result in arbitrary code execution.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-24 14:42 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
0 , < 6.2.3.0
(custom)
|
|
| fujielectric | monitouch_v-sft |
Affected:
0 , ≤ 6.2.3.0
(custom)
cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "monitouch_v-sft",
"vendor": "fujielectric",
"versions": [
{
"lessThanOrEqual": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-24T14:42:08.803828Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-24T14:42:21.260Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:11.627Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a\n type confusion, which could result in arbitrary code execution."
}
],
"value": "Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a\n type confusion, which could result in arbitrary code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-18T17:45:36.547Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Fuji Electric recommends users update the product to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd\"\u003eMonitouch V-SFT v6.2.3.0\u003c/a\u003e.\n\n\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update the product to Monitouch V-SFT v6.2.3.0 https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd ."
}
],
"source": {
"advisory": "ICSA-24-151-02",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-5271",
"datePublished": "2024-05-30T19:53:30.195Z",
"dateReserved": "2024-05-23T14:36:06.242Z",
"dateUpdated": "2025-07-24T14:42:21.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-34171 (GCVE-0-2024-34171)
Vulnerability from nvd – Published: 2024-05-30 19:55 – Updated: 2024-08-02 02:51
VLAI
EPSS
VEX
Title
Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow
Summary
Fuji Electric Monitouch V-SFT
is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-25 18:32 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fuji Electric | Monitouch V-SFT |
Affected:
0 , < 6.2.3.0
(custom)
|
|
| fujielectric | monitouch_v-sft |
Affected:
0 , < 6.2.3.0
(custom)
cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fujielectric:monitouch_v-sft:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "monitouch_v-sft",
"vendor": "fujielectric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-34171",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-25T18:32:35.936779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T18:33:50.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:51:09.599Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Monitouch V-SFT",
"vendor": "Fuji Electric",
"versions": [
{
"lessThan": "6.2.3.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "kimiya working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nFuji Electric Monitouch V-SFT \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code.\n\n"
}
],
"value": "Fuji Electric Monitouch V-SFT \nis vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-30T19:55:23.835Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-151-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\nFuji Electric recommends users update the product to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd\"\u003eMonitouch V-SFT v6.2.3.0\u003c/a\u003e.\n\n\u003cbr\u003e"
}
],
"value": "Fuji Electric recommends users update the product to Monitouch V-SFT v6.2.3.0 https://felib.fujielectric.co.jp/en/M10009/M20104/document_detail/55ff739b-bd06-4241-b078-3b9c9728bdfd ."
}
],
"source": {
"advisory": "ICSA-24-151-02",
"discovery": "EXTERNAL"
},
"title": "Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-34171",
"datePublished": "2024-05-30T19:55:23.835Z",
"dateReserved": "2024-05-20T14:11:06.275Z",
"dateUpdated": "2024-08-02T02:51:09.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}