Opto 22 PAC Control Stack Buffer Overflow Vulnerability (CVE-2018-14807)

Key Information Vulnerability Details - CVSS v3.8.4 - Threat Level: Remotely exploitable / Low technical difficulty to exploit - Vendor: Opto 22 - Affected Devices: PAC Control Basic and PAC Control Professional - Vulnerability Type: Stack-based buffer overflow Risk Assessment - Successful exploitation of this vulnerability could cause the affected device to crash, and the buffer overflow condition may allow remote code execution. Technical Details - Affected Products - PAC Control Basic versions R10.0a and earlier - PAC Control Professional versions R10.0a and earlier - Vulnerability Overview - CWE: CWE-121 Stack-based Buffer Overflow - CVE: CVE-2018-14807 has been assigned to this vulnerability. Its CVSS v3 base score is 8.4, with the CVSS vector string: - Background - Critical Infrastructure Sectors: Multiple - Deployment Regions: Global - Company Headquarters Location: United States - Researcher - Robert Hawes reported this vulnerability to NCCIC Mitigations - Opto 22 recommends users upgrade to the latest version - NCCIC recommends users implement defensive measures to minimize the risk of exploitation: - Minimize network exposure of all control system devices and/or systems, ensuring they are not accessible from the internet - Place control system networks and remote devices behind firewalls and isolate them from enterprise networks - If remote access is required, use secure methods such as Virtual Private Networks (VPNs), and recognize that VPNs may have vulnerabilities; ensure they are updated to the latest available versions. Additionally, the security of a VPN is only as strong as the security of the connected devices - NCCIC reminds organizations to conduct appropriate impact analysis and risk assessment before deploying defensive measures Vendor - Opto 22

Goal Reached Thanks to every supporter — we hit 100%!

Opto 22 PAC Control Stack Buffer Overflow Vulnerability (CVE-2018-14807)