CVE-2018-7527

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A buffer overflow can be triggered in LeviStudio HMI Editor, Version 1.10 part of Wecon LeviStudioU 1.8.29, and PI Studio HMI Project Programmer, Build: November 11, 2017 and prior by opening a specially crafted file.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
WECON Technology Co., Ltd.	LeviStudio HMI Editor	Version 1.10 part of Wecon LeviStudioU 1.8.29 and prior
WECON Technology Co., Ltd.	PI Studio HMI Project Programmer	Build: November 11, 2017 and prior

References

http://www.securityfocus.com/bid/104016Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-116-02Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/104016Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-116-02Third Party Advisory, US Government Resource

Timeline

Published: Apr 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-75289.1An SQL injection vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP ca CVE-2018-75297.5A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modif CVE-2018-75307.8Parsing malformed project files in Omron CX-One versions 4.42 and prior, including the following applications: CX-FLnet versions 1.00 and pr CVE-2018-75315.9An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalida CVE-2018-75329.8Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP CVE-2018-75337.8An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may CVE-2018-75344.7In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.CVE-2018-75357.8An issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of the product's files because of weak permiss CVE-2018-75365.3An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was CVE-2018-75375.3An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and CVE-2018-75389.8A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to e CVE-2018-75399.8On Appear TV XC5000 and XC5100 devices with firmware 3.26.217, it is possible to read OS files with a specially crafted HTTP request (such a