Kostac PLC Programming Software Out-of-Bounds Write/Stack Overflow Vulnerabilities (CVE-2024-47134/47135/47136)

From this webpage screenshot, the following key information about the vulnerabilities can be obtained: 1. Affected Product: - Kostac PLC Programming Software (formerly Koyo PLC Programming Software) version 1.6.14.0 and earlier versions. 2. Vulnerability Description: - Out-of-bounds Write (CWE-787): CVSS Base Score 7.8, CVE-2024-47134. - Stack Overflow (CWE-121): CVSS Base Score 7.8, CVE-2024-47135. - Out-of-bounds Read (CWE-125): CVSS Base Score 7.8, CVE-2024-47136. 3. Impact: - Opening project files saved using Kostac PLC Programming Software version 1.6.9.0 or earlier may lead to denial-of-service (DoS) conditions, arbitrary code execution, and/or information disclosure. 4. Mitigation: - Update Software: Upgrade Kostac PLC Programming Software to the latest version, which includes patches for these vulnerabilities. - Workaround: Re-save project files originally saved with Kostac PLC Programming Software version 1.6.9.0 or earlier using version 1.6.10.0 or later. 5. Vendor Status: - JTEKT ELECTRONICS CORPORATION: Vulnerable, last updated on 2024/10/02. 6. Reference Links: - JPCERT/CC Addendum - Vulnerability Analysis by JPCERT/CC - Credit: Michael Heinzl reported these vulnerabilities; JPCERT/CC coordinated with the developers. 7. Additional Information: - JPCERT Alert - JPCERT Reports - CERT Advisory - CPNI Advisory - TRnotes - CVE IDs: CVE-2024-47134, CVE-2024-47135, CVE-2024-47136 - JVN iPedia This information provides a detailed description of multiple vulnerabilities in Kostac PLC Programming Software, including their impact, mitigation steps, and relevant reference links.

Goal Reached Thanks to every supporter — we hit 100%!

Kostac PLC Programming Software Out-of-Bounds Write/Stack Overflow Vulnerabilities (CVE-2024-47134/47135/47136)