CVE-2019-6530

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows, which may lead to remote code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
Panasonic	FPWIN Pro	Version 7.3.0.0 and prior

References

http://www.securityfocus.com/bid/108683Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-565/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-19-567/Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/108683Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-157-02Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-565/Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-19-567/Third Party Advisory, VDB Entry

Timeline

Published: Jun 7, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65318.1An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Softw CVE-2019-65327.8Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompa CVE-2019-65339.1Registers used to store Modbus values can be read and written from the web interface without authentication in the PR100088 Modbus gateway v CVE-2019-65347.8The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 en CVE-2019-65357.5Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU,CVE-2019-65367.8Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may CVE-2019-65377.8Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings wit CVE-2019-65386.5The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLi CVE-2019-65397.8Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbit CVE-2019-65406.5The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLi CVE-2019-65417.8A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code executio CVE-2019-65427.5ENTTEC Datagate MK2, Storm 24, Pixelator all firmware versions prior to (70044,70050,70060)_update_05032019-482 allows an unauthenticated us