CVE-2018-3991
critical · 10An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management, version 6.40.2402.500. A specially crafted TCP packet can cause a heap overflow, potentially leading to remote code execution. An attacker can send a malformed TCP packet to trigger this vulnerability.
10
CVSS
34.3%
EPSS (exploit prob.)
98th
EPSS percentile
2019-02-05
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-787
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| wibu | wibukey | 6.40.2402.500 |
| microsoft | windows | all versions |
| siemens | simatic_wincc_open_architecture | 3.14 |
| siemens | simatic_wincc_open_architecture | 3.15 |
| siemens | simatic_wincc_open_architecture | 3.16 |
Check a specific version with /api/v1/cve/match.
References
- http://www.securityfocus.com/bid/107005
- https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0659
- http://www.securityfocus.com/bid/107005
- https://cert-portal.siemens.com/productcert/pdf/ssa-760124.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-902727.pdf
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0659
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-3991