CVE-2018-17913

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an attacker to execute code in the context of the application.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-704

Affected software

Vendor	Product	Versions
Omron	CX-Supervisor	Versions 3.4.1.0 and prior.

References

http://www.securityfocus.com/bid/105691Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/105691Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-290-01Third Party Advisory, US Government Resource

Timeline

Published: Nov 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179149.8InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vuln CVE-2018-179159.8All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMey CVE-2018-179169.8InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote CVE-2018-179175.3All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potenti CVE-2018-179189.8Circontrol CirCarLife all versions prior to 4.3.1, authentication to the device can be bypassed by entering the URL of a specific page.CVE-2018-179196.5All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "defa CVE-2018-17927.8IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code CVE-2018-179218.8SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that may allow an attacker to force-pair the device without CVE-2018-179229.8Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessib CVE-2018-179236.9SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to an attack that an attacker with physical access to the product may abl CVE-2018-179248.6Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could s CVE-2018-179254.8Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX