CVE-2018-10620

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-19 · updated 2026-06-17
Weakness: CWE-121

Description

AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.

Affected products

AVEVA Software, LLC InduSoft Web Studio: 8.1, 8.1-sp1
AVEVA Intouch Machine 2017: 8.1, 8.1-sp1

References

http://www.securityfocus.com/bid/104870
https://ics-cert.us-cert.gov/advisories/ICSA-18-200-01
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec128%28002%29.pdf
https://www.tenable.com/security/research/tra-2018-19
http://www.securityfocus.com/bid/104870
https://ics-cert.us-cert.gov/advisories/ICSA-18-200-01
https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec128%28002%29.pdf
https://www.tenable.com/security/research/tra-2018-19

Get alerted when CVE-2018-10620 or the next vulnerability affects your stack