CVE-2017-13999

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified in which the application does not verify string size before copying to memory; the attacker may then be able to crash the application or run arbitrary code.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
n/a	WECON Technology Co., Ltd. LeviStudio HMI Editor	WECON Technology Co., Ltd. LeviStudio HMI Editor

References

http://www.securityfocus.com/bid/101250Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/102493
https://ics-cert.us-cert.gov/advisories/ICSA-17-285-02Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/101250Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/102493
https://ics-cert.us-cert.gov/advisories/ICSA-17-285-02Third Party Advisory, US Government Resource

Timeline

Published: Oct 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-140009.4An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. By accessing a speci CVE-2017-140018.8An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS comm CVE-2017-140029.8GE Infinia/Infinia with Hawkeye 4 medical imaging systems all current versions are affected these devices use default or hard-coded credenti CVE-2017-140039.8An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and p CVE-2017-140049.8GE GEMNet License server (EchoServer) all current versions are affected these devices use default or hard-coded credentials. Successful expl CVE-2017-140058.8An Unverified Password Change issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When setting a new password for a u CVE-2017-140069.8GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded CVE-2017-140075.6An Insufficient Session Expiration issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The user's session is availabl CVE-2017-140089.8GE Centricity PACS RA1000, diagnostic image analysis, all current versions are affected these devices use default or hard-coded credentials.CVE-2017-140096.5An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Chang CVE-2017-140107.8In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerabilit CVE-2017-140118.8A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The application does not sufficientl