CVE-2018-7502

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Kernel drivers in Beckhoff TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, and TwinCAT 3.1 lack proper validation of user-supplied pointer values. An attacker who is able to execute code on the target may be able to exploit this vulnerability to obtain SYSTEM privileges.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-822 CWE-20

Affected software

Vendor	Product	Versions
ICS-CERT	Beckhoff TwinCAT PLC products	TwinCAT 3.1 Build 4022.4, TwinCAT 2.11 R3 2259, TwinCAT 3.1

References

http://www.securityfocus.com/bid/103487Third Party Advisory, VDB Entry
https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02Mitigation, Third Party Advisory, US Government Resource
https://srcincite.io/advisories/src-2018-0007/
http://www.securityfocus.com/bid/103487Third Party Advisory, VDB Entry
https://download.beckhoff.com/download/Document/product-security/Advisories/advisory-2018-001.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-081-02Mitigation, Third Party Advisory, US Government Resource
https://srcincite.io/advisories/src-2018-0007/

Timeline

Published: Mar 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-75037.5In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio CVE-2018-75046.1A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is no CVE-2018-75059.8In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prio CVE-2018-75067.5The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may a CVE-2018-75078.8WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read CVE-2018-75086.1A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is i CVE-2018-75098.8WPLSoft in Delta Electronics versions 2.45.0 and prior writes data from a file outside the bounds of the intended buffer space, which could CVE-2018-75109.8In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are CVE-2018-75115.3In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in CVE-2018-75126.1A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 CVE-2018-75135.3In Omron CX-Supervisor Versions 3.30 and prior, parsing malformed project files may cause a stack-based buffer overflow.CVE-2018-75147.8Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and pr