CVE-2019-18236

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple buffer overflow vulnerabilities exist when the PLC Editor Version 1.3.5_20190129 processes project files. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-119

Affected software

Vendor	Product	Versions
n/a	WECON PLC Editor	Version 1.3.5_20190129

References

https://www.us-cert.gov/ics/advisories/icsa-19-353-03Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-1033/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-19-1034/Third Party Advisory, VDB Entry
https://www.us-cert.gov/ics/advisories/icsa-19-353-03Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-1033/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-19-1034/Third Party Advisory, VDB Entry

Timeline

Published: Dec 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-182387.5In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive informatio CVE-2019-18248.1A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manage CVE-2019-182409.8In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely CVE-2019-182416.5In Philips IntelliBridge EC40 and EC80, IntelliBridge EC40 Hub all versions, and IntelliBridge EC80 Hub all versions, the SSH server running CVE-2019-182427.5In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, frequent and multipl CVE-2019-182435.5HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. Th CVE-2019-182444.7In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts ar CVE-2019-182457.8Reliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert malicious code into the system root path, CVE-2019-182464.3BIOTRONIK CardioMessenger II, The affected products do not properly enforce mutual authentication with the BIOTRONIK Remote Communication in CVE-2019-182477.5An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 series (versions 1.2.3 CVE-2019-182484.3BIOTRONIK CardioMessenger II, The affected products transmit credentials in clear-text prior to switching to an encrypted communication chan CVE-2019-182496.1Reliable Controls MACH-ProWebCom/Sys, all versions prior to 2.15 (Firmware versions prior to 8.26.4), may allow attacker to execute commands