CVE-2019-6541
published 2019-02-13CVE-2019-6541: A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code execution. Mat Powell, Ziad…
PriorityP338high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.59%
72.6th percentile
A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ics-cert | wecon_levistudiou | — | — |
| we-con | levistudiou | <= 1.8.56 | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rwjp-vxm5-v8j3: A memory corruption vulnerability has been identified in WECON LeviStudioU version 1
ghsa_unreviewed·2022-05-13
CVE-2019-6541 [HIGH] CWE-787 GHSA-rwjp-vxm5-v8j3: A memory corruption vulnerability has been identified in WECON LeviStudioU version 1
A memory corruption vulnerability has been identified in WECON LeviStudioU version 1.8.56 and prior, which may allow arbitrary code execution. Mat Powell, Ziad Badawi, and Natnael Samson working with Trend Micro's Zero Day Initiative, reported these vulnerabilities to NCCIC.
CISA ICS
WECON LeviStudioU (Update A)
cisa_ics·2019-02-05·CVSS 7.8
[HIGH] WECON LeviStudioU (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
WECON LeviStudioU (Update A)
Last RevisedSeptember 20, 2019
Alert CodeICSA-19-036-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.8
- ATTENTION: Low skill level to exploit
- Vendor: WECON Technology Co., Ltd (WECON)
- Equipment: LeviStudioU
- Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Memory Corruption
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-036-03 WECON LeviStudioU that was published February 5, 2019, on the ICS webpage on us-cert.gov.
## 3. RISK EVALUATION
Successful exploitation of the
No detection rules found.
No public exploits indexed.
2019-02-13
Published