CVE-2018-10617

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-119

Affected software

Vendor	Product	Versions
Delta Electronics	Delta Industrial Automation DOPSoft	Version 4.00.04 and prior.

References

http://www.securityfocus.com/bid/104375Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/104375Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01Third Party Advisory, US Government Resource

Timeline

Published: Jun 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-106189.8Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote CVE-2018-106197.8An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may CVE-2018-10625.3A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks CVE-2018-106209.8AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully cra CVE-2018-106219.8Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length stack buffer where a value larger th CVE-2018-106225.2Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credent CVE-2018-106239.8Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the positi CVE-2018-106244.3In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from impro CVE-2018-106264.4Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who o CVE-2018-106279.8Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions CVE-2018-106289.8AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a CVE-2018-10634.4Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELin