CVE-2019-6537
published 2019-02-13CVE-2019-6537: Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.90%
77.1th percentile
Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage these vulnerabilities to execute code under the context of the current process. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ics-cert | wecon_levistudiou | — | — |
| we-con | levistudiou | <= 1.8.56 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
WECON LeviStudioU (Update A)
cisa_ics·2019-02-05·CVSS 7.8
[HIGH] WECON LeviStudioU (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
WECON LeviStudioU (Update A)
Last RevisedSeptember 20, 2019
Alert CodeICSA-19-036-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low skill level to exploit
- Vendor: WECON Technology Co., Ltd (WECON)
- Equipment: LeviStudioU
- Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Memory Corruption
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-036-03 WECON LeviStudioU that was published February 5, 2019, on the ICS webpage on us-cert.gov.
## 3. RISK EVALUATION
Successful exploitation of the
GHSA
GHSA-8f2m-6jch-cp65: Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1
ghsa_unreviewed·2022-05-13
CVE-2019-6537 [HIGH] CWE-787 GHSA-8f2m-6jch-cp65: Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1
Multiple stack-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior may be exploited when parsing strings within project files. The process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage these vulnerabilities to execute code under the context of the current process. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-02-13
Published