CVE-2018-14814

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
WECON	WECON Technology PI Studio HMI	PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01Third Party Advisory, US Government Resource

Timeline

Published: Mar 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-148159.8Fuji Electric V-Server 4.0.3.0 and prior, Several out-of-bounds write vulnerabilities have been identified, which may allow remote code exec CVE-2018-148169.8Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an CVE-2018-148179.8Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.CVE-2018-148189.8WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow CVE-2018-148199.8Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remote code execution.CVE-2018-148207.5Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which CVE-2018-148217.5Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intent CVE-2018-148229.8Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, wh CVE-2018-148239.8Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execu CVE-2018-148246.5Delta Electronics Delta Industrial Automation PMSoft v2.11 or prior has an out-of-bounds read vulnerability that can be executed when proces CVE-2018-148255.8On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android O CVE-2018-148269.8Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with