CVE-2018-7817
published 2019-02-06CVE-2018-7817: A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially…
PriorityP341high7.8CVSS 3.0
AVLACLPRNUIRSUCHIHAH
EPSS
3.04%
86.0th percentile
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | zelio_soft_2 | <= 5.1 | — |
| schneider_electric_se | zelio_soft_2_v5.1_and_prior_versions | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric Zelio Soft 2
cisa_ics·2019-01-08·CVSS 7.8
[HIGH] Schneider Electric Zelio Soft 2
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric Zelio Soft 2
Last RevisedJanuary 08, 2019
Alert CodeICSA-19-008-01
## 1. EXECUTIVE SUMMARY
-
CVSS v3 7.8
- ATTENTION: Low skill level to exploit
- Vendor: Schneider Electric
- Equipment: Zelio Soft 2
- Vulnerability: Use After Free
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow for remote code execution when opening a specially crafted project file.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Zelio Soft, a programing platform, are affected:
- Zelio Soft 2 Versions 5.1 and prior.
## 3.2
GHSA
GHSA-gqvq-6vv2-x27p: A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5
ghsa_unreviewed·2022-05-13
CVE-2018-7817 [HIGH] CWE-416 GHSA-gqvq-6vv2-x27p: A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5
A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/106481https://ics-cert.us-cert.gov/advisories/ICSA-19-008-01https://www.schneider-electric.com/en/download/document/SEVD-2018-361-01/http://www.securityfocus.com/bid/106481https://ics-cert.us-cert.gov/advisories/ICSA-19-008-01https://www.schneider-electric.com/en/download/document/SEVD-2018-361-01/
2019-02-06
Published