CVE-2019-6539
published 2019-02-13CVE-2019-6539: Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
2.11%
79.5th percentile
Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ics-cert | wecon_levistudiou | — | — |
| we-con | levistudiou | <= 1.8.56 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
WECON LeviStudioU (Update A)
cisa_ics·2019-02-05·CVSS 7.8
[HIGH] WECON LeviStudioU (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
WECON LeviStudioU (Update A)
Last RevisedSeptember 20, 2019
Alert CodeICSA-19-036-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low skill level to exploit
- Vendor: WECON Technology Co., Ltd (WECON)
- Equipment: LeviStudioU
- Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Memory Corruption
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-036-03 WECON LeviStudioU that was published February 5, 2019, on the ICS webpage on us-cert.gov.
## 3. RISK EVALUATION
Successful exploitation of the
GHSA
GHSA-3qfx-cxcm-pc2c: Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1
ghsa_unreviewed·2022-05-13
CVE-2019-6539 [HIGH] CWE-787 GHSA-3qfx-cxcm-pc2c: Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1
Several heap-based buffer overflow vulnerabilities in WECON LeviStudioU version 1.8.56 and prior have been identified, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-02-13
Published