CVE-2018-14807: A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.

PriorityP258critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

3.13%

86.2th percentile

A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
opto22	pac_control	<= r10.0a	—
opto_22	pac_control_basic_and_pac_control_professional	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerability is a stack-based buffer overflow (CWE-121) in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior; monitor for anomalous remote connections or crashes targeting these products ↗
→Successful exploitation may cause a device crash followed by potential remote code execution; unexpected process crashes on PAC Control systems should be investigated as possible exploitation attempts ↗

·No known public exploits specifically target this vulnerability at time of advisory publication ↗
·Vulnerability is rated exploitable remotely with low skill level required; CVSS v3 base score 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — note the attack vector is listed as Local (AV:L) despite being described as remotely exploitable, which may affect detection scoping ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.