CVE-2018-17901

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

LAquis SCADA Versions 4.1.0.3870 and prior, when processing project files the application fails to sanitize user input prior to performing write operations on a stack object, which may allow an attacker to execute code under the current process.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
LCDS - Leão Consultoria e Desenvolvimento de Sistemas LTDA ME	LAquis SCADA	4.1.0.3870 and prior

References

http://laquisscada.com/instale1.phpProduct, Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-289-01Third Party Advisory, US Government Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/151421Third Party Advisory
http://laquisscada.com/instale1.phpProduct, Vendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-289-01Third Party Advisory, US Government Resource

Timeline

Published: Oct 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179025.3Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of sess CVE-2018-179039.1SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.CVE-2018-179046.1Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code.CVE-2018-179057.8When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may oc CVE-2018-179068.8Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authenticatio CVE-2018-179073.3When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can f CVE-2018-179087.8WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it af CVE-2018-179097.8When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed m CVE-2018-17914.9IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request proper CVE-2018-179107.8WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow c CVE-2018-179117.8LAquis SCADA Versions 4.1.0.3870 and prior has several stack-based buffer overflow vulnerabilities, which may allow remote code execution.CVE-2018-179127.5An XXE vulnerability exists in CASE Suite Versions 3.10 and prior when processing parameter entities, which may allow remote file disclosure