« Volver al listado

CVE-2018-14814

Estado: ModificadaMedia (6.5)—

WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

We-con — PI StudioWe-con — PI Studio HMI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-14814",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "WECON",
          "product": "WECON Technology PI Studio HMI",
          "versions": [
            {
              "status": "affected",
              "version": "PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-27T20:29:03.660",
  "references": [
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-277-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result in a read past the end of an allocated object."
    },
    {
      "lang": "es",
      "value": "WECON Technology PI Studio HMI, en versiones 4.1.9 y anteriores, así como PI Studio en versiones 4.2.34 y anteriores, carece de una validación adecuada de los datos proporcionados por el usuario, lo que podría resultar en una lectura más allá del final de un objeto asignado."
    }
  ],
  "lastModified": "2026-06-17T01:41:41.690",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:we-con:pi_studio:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9204D3F4-D3DA-4EA4-A932-950F721DB135",
              "versionEndIncluding": "4.2.34"
            },
            {
              "criteria": "cpe:2.3:a:we-con:pi_studio_hmi:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "159E2064-BDBD-4354-A8AC-2894EAA39248",
              "versionEndIncluding": "4.1.9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}