CVE-2018-19018

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

An access of uninitialized pointer vulnerability in CX-Supervisor (Versions 3.42 and prior) could lead to type confusion when processing project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.

Metrics

CVSS 3.0 7.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-824

Affected software

Vendor	Product	Versions
ICS-CERT	CX-Supervisor	Versions 3.42 and prior

References

https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01Mitigation, Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-19-017-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Feb 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-190197.3A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a spec CVE-2018-19024.3IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to CVE-2018-190205.0When CX-Supervisor (Versions 3.42 and prior) processes project files and tampers with the value of an offset, an attacker can force the appl CVE-2018-190216.5A specially crafted script could bypass the authentication of a maintenance port of Emerson DeltaV DCS Versions 11.3.1, 11.3.2, 12.3.1, 13.3 CVE-2018-190238.8Hetronic Nova-M prior to verson r161 uses fixed codes that are reproducible by sniffing and re-transmission. This can lead to unauthorized r CVE-2018-190259.8In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware CVE-2018-190277.8Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project CVE-2018-190297.8LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled CVE-2018-19036.7IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNI CVE-2018-190318.8A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects CVE-2018-190369.8An issue was discovered in several Bosch IP cameras for firmware versions 6.32 and higher. A malicious client could potentially succeed in t CVE-2018-190377.5On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep